A study has scrutinised 21,097 MCP servers and demonstrated how a booby-trapped argument causes a tool to deviate from its stated purpose; 13 security advisories followed, including two CVEs in Anthropic’s Git server.
The Model Context Protocol (MCP) standardizes the way AI agents call external tools. Each tool describes a contract: a name, a description, an argument scheme. But in local deployment, accepting a tool call often means letting the server process freely access the machine's file system, well beyond the announced operation. Researchers call this flaw "file system whitewashing": by directing arguments, an attacker tricks a tool into reading sensitive files outside its perimeter.
To measure the extent of the problem, the team designed MCP-FSD, which lists servers, deducts the minimum necessary rights for each tool, places fake credentials outside of that area, and then verifies in actual execution whether the tool manages to reach them and whether the sandbox retains it. Out of 21,097 servers from nine registries, 4,806 were examined: 787 (16.4%) have file access even though their function has nothing to do with file management. Dynamic tests confirmed 150 usable cases in the sandbox configurations studied.
The coordinated disclosure resulted in 13 security advisories, including two CVEs targeting Anthropic's MCP Git server.
Read the full article on the original source
Go to the source →