My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
[Kryptografia i bezpieczeństwo] Autorzy: Zeqian Huang, Mingyue Tang, Aonan Guan i 2 więcej
The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluat…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo