LATIDIA · Ciberseguridad

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

arXiv:2610.22301v1 Announce Type: new Abstract: The Model Context Protocol (MCP) estandariza cómo los agentes de IA invocan herramientas externas. Los servidores MCP exponen las herramientas a través de un contrato declarado que consiste en un nombre, una descripción, un

La noticia

arXiv:2610.22301v1 Announce Type: new Abstract: The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD