My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
The Model Context Protocol (MCP) allows AI agents to use external tools, but client-side approval often grants servers too much access to the host filesystem. This study found a vulnerability called filesystem capability laundering where attacker-controlled inputs trick tools into accessing sensitive files outside their intended scope. The proposed MCP-FSD framework detects these risks by cataloging servers, inferring least-privilege boundaries, and testing for exploits.