MCP 服务器文件系统能力洗白漏洞研究：21,097 个服务器中 787 个越权
My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
研究扫了 2 万多个 MCP 服务器，发现 16.4% 会偷读声明范围外的文件，连 Anthropic 官方 Git 服务器都有 CVE，自己搭 MCP 的必看。
arXiv 论文提出 filesystem capability laundering（文件系统能力洗白）这一漏洞类别：攻击者通过构造参数，让 MCP 工具访问其声明契约之外的主机敏感文件。研究团队设计了 MCP-FSD 工具，对来自九个注册表的 21,097 个 MCP 服务器进行筛查，其中 787 个（16.4%）在非文件系统分类下仍具备文件系统访问能力。动态三案例验证确认了 150 个可利用的漏洞实例，协调披露后产出 13 份安全通告，包括 Anthropic Git MCP Server 中的两个 CVE。
My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluate exploitability and sandbox containment via paired dynamic execution. Across 21,097 MCP servers from nine registries, 787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite non-filesystem functional classifications. Dynamic three-case validation confirms 150 vulnerable instances under tested sandbox policies. Coordinated disclosure yielded 13 security advisories, including two CVEs in Anthropic's Git MCP Server.
