My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
A large-scale scan found 16% of sampled MCP servers can access host files their declared tool contract never mentions.
Researchers built a tool called MCP-FSD to scan 21,097 Model Context Protocol servers across nine registries for a vulnerability class they call filesystem capability laundering: tools that gain broad host filesystem access despite a declared contract that implies no such capability. Of 4,806 triaged servers, 787 (16.4%) showed this mismatch, and dynamic testing confirmed 150 exploitable instances, leading to 13 coordinated security advisories including two CVEs in Anthropic's own Git MCP Server.
Why it matters
This is a systematic, large-scale study showing that MCP's trust model, where approving a tool call grants the underlying process broad filesystem access rather than scoping it to the declared operation, is exploitable at meaningful scale across the ecosystem, not a one-off bug. The fact that it reached even Anthropic's own reference Git MCP Server underscores that this is a protocol-level design gap, not just sloppy third-party implementations.
What is verified
Researchers analyzed 21,097 MCP servers from nine registries and triaged 4,806 of them for filesystem capability mismatches. [1]
787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite being classified as non-filesystem tools. [1]
Dynamic validation confirmed 150 vulnerable instances under tested sandbox policies. [1]
Coordinated disclosure from this research yielded 13 security advisories, including two CVEs in Anthropic's Git MCP Server. [1]
The vulnerability class, termed filesystem capability laundering, occurs because client-side approval of an MCP tool call often grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. [1]
What is not
- The paper does not name which 13 advisories or which registries/servers beyond Anthropic's Git MCP Server were affected, limiting ability to assess direct exposure.
- No detail on which specific sandbox policies were tested or how representative they are of production MCP deployments.
- Unclear how many of the 21,097 servers are in active production use versus experimental/abandoned projects.
- No information on remediation guidance or whether affected servers have been patched at time of publication.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 15 October 2026 at 19:48.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.