Filesystem vulnerabilities affect many AI tool servers at scale
My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
Cryptography and Security
Summary
Some AI tool servers allow external programs to access more of the computer’s files than they are supposed to. The authors found this happens because of a gap between what the server says a tool can do and what it can actually do behind the scenes. They built a system to check thousands of servers to find those vulnerable to this problem. They confirmed that many servers—even some well-known ones—can be tricked into exposing sensitive files.
What this means in practice
- •For security teams: Identify and fix filesystem permission leaks in AI tool servers before attackers can exploit them.
- •For ai platform operators: Improve server deployments by enforcing strict filesystem access aligned with declared tool capabilities.
Authors
Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun, Pengzhou He
Abstract
The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluate exploitability and sandbox containment via paired dynamic execution. Across 21,097 MCP servers from nine registries, 787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite non-filesystem functional classifications. Dynamic three-case validation confirms 150 vulnerable instances under tested sandbox policies. Coordinated disclosure yielded 13 security advisories, including two CVEs in Anthropic's Git MCP Server.