Research
“My Credentials, Please”: Detecting Filesystem Capability Laundering in MCP Servers at Scale
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 29 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
MCP tool-call approval can leave server processes with broader filesystem access than the approved operation requires, making host credentials vulnerable unless filesystem boundaries are independently enforced.
The MCP-FSD study examines filesystem capability laundering, where attacker-steered MCP tool arguments access sensitive host files beyond a tool’s declared contract and deployment scope. Researchers cataloged 21,097 MCP servers and dynamically confirmed 150 vulnerable instances under tested sandbox policies. Coordinated disclosure yielded 13 security advisories, including two CVEs in Anthropic’s Git MCP Server.