Detecting Filesystem Capability Laundering in MCP Servers at Scale (arxiv.org)

A recent study titled "My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale" highlights a significant vulnerability within the Model Context Protocol (MCP) used by AI agents to invoke external tools. The research reveals that MCP servers often grant excessive filesystem permissions, allowing attackers to manipulate tool calls to access sensitive files outside their designated authority. This phenomenon, termed 'filesystem capability laundering,' underscores vulnerabilities across three layers of server implementation, leading to the identification of 150 instances across 21,097 MCP servers that pose a potential security risk. This discovery is crucial for the AI/ML community as it emphasizes the need for stricter security measures when deploying AI tools, especially as they increasingly integrate with broader systems. The study's findings suggest a widespread prevalence of insecure configurations within MCP environments, necessitating immediate attention to privilege management and permission settings. The deployment of MCP-FSD for cataloging and analyzing server capabilities optimizes the identification of vulnerabilities, paving the way for enhanced protective measures and potential security advisories, including newly recognized CVEs. Overall, this research contributes to building more resilient AI systems by addressing fundamental security flaws in existing implementations.