A framework tests local tools for filesystem leaks
In plain words
A local tool server may be able to read more files than its tool description suggests, even after a person approves a call. MCP-FSD is a framework that screens server code, estimates which files each tool should access, and tests whether a tool can reveal a planted credential outside that area.
In 150 selected tool-policy pairs, all three checks passed: an unsandboxed malicious attempt, a successful benign operation with the sandbox, and containment of the sandboxed attempt. Exact credential-marker matching supported 136 cases; other transcript evidence, including write side effects or response-shape changes, was used for the remaining 14. These results apply to tested cases and inferred boundaries.
The research
When a local tool call is approved, does that approval actually limit which files the server can access? If attacker-influenced arguments can steer a tool beyond its intended scope, file contents may be exposed through an ordinary tool response. The paper asks how to find and contain that gap.
MCP-FSD screens local tool servers, infers file-access boundaries and tests whether out-of-scope disclosure occurs and sandboxing contains it.
MCP-FSD screens local servers, infers a tentative file boundary for each tool, then tests whether a planted credential is disclosed beyond that boundary and whether sandboxing contains the attempt. Its checks also ask whether a benign in-scope operation still succeeds.
Across 150 unique tool-policy pairs, all three checks passed. Exact credential-marker matching supported 136 cases; the remaining 14 were adjudicated using other transcript evidence, including write side effects, response-shape changes, or external-CLI outputs.
Together, these outcomes support the finding that selected instances showed filesystem capability laundering and that the tested sandbox policies contained the attempts while preserving benign operations.
The results cover servers that could be installed and run, and use inferred boundaries rather than independently verified authorization rules. The response-focused tests may miss filesystem effects that do not appear in a response or require unreproduced conditions.
Analysis
Deep
- Original paper authors
- Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun, Pengzhou He
- Submitted to arXiv
- License
- CC BY 4.0