My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "My Credentials, Please".

Elias: The gist The Model Context Protocol (MCP) standardizes how AI agents invoke external tools,

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: This paper, "My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale," is essentially about showing how filesystem capability laundering happens when AI agents use the Model Context Protocol to call external tools. The authors claim that attacker-steered arguments can cause a tool to access sensitive host files way outside of what its contract or deployment actually allows.

Elias: They look at this gap across three layers: server-category screening, which is L1, per-tool contract analysis, which is L2, and bypassable path validation checks, which is L3.

Priya: What this means for the data we see in the paper is that they found seven hundred eighty-seven out of four thousand eight hundred six triaged servers that show filesystem capabilities even though they aren't classified as filesystem tools at all.

Nadia: They also confirm one hundred fifty vulnerable instances when testing these under sandbox policies and they found two specific CVEs in Anthropic’s Git MCP Server during coordinated disclosure.

Elias: The methodology involves designing MCP-FSD to catalog the servers, infer the least-privilege boundaries for each tool, plant credential fixtures outside those boundaries, and then test how exploitable these are using paired dynamic execution.

Priya: The paper highlights that they use an LLM for static screening to identify tool registrations and handlers and then uses a boundary inference algorithm based on launch configurations, schema fields, tool descriptions, and repository signals to build a policy hypothesis.

Nadia: They also have this three-case dynamic validation where they test if the malicious payload succeeds without the sandbox but only when it contains specific planted credential contents under the sandbox.

Elias: This validation pass confirms that detected disclosures really represent vulnerabilities that are fixed by having proper least-privilege containment in place.

Priya: One limitation they mention is that their method only validates servers they can actually install and run, which means we still don't know what happens on the servers we can't reach.

Conclusion: Nadia: So to wrap up "My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale," the authors are showing that filesystem capability laundering is a real threat where ordinary tool interactions can leak host credentials because the server runs with ambient permissions.

Elias: They built MCP-FSD to bridge this gap by coupling static screening with inferred least-privilege boundaries and dynamic three-case validation across twenty-one thousand ninety-seven cataloged servers.

Priya: The implications are that anyone building something with AI agents needs to look beyond just checking if a tool exists; you need to check exactly what permissions that tool can possibly access on your host system.

Nadia: It moves the conversation from just hoping client approval works to actually proving it does or doesn't work under stress using those three validation cases.

Elias: They point out that ecosystem-scale registry screening and runtime contracts are necessary because you can't secure this by looking at one tool in isolation; you need the whole system checked.

Priya: If you're building something that uses AI agents, it’s a warning that the scope of your tool isn't what you think it is when it runs on a shared host system.