Searcharxiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.22301

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

Zeqian Huang·Mingyue Tang·Aonan Guan·Qiming Sun·Pengzhou He
View original source ↗Read source document ↗Export metadata ↓

Abstract

The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluate exploitability and sandbox containment via paired dynamic execution. Across 21,097 MCP servers from nine registries, 787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite non-filesystem functional classifications. Dynamic three-case validation confirms 150 vulnerable instances under tested sandbox policies. Coordinated disclosure yielded 13 security advisories, including two CVEs in Anthropic's Git MCP Server.

Explore related subjects

cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun, Pengzhou He. 2026-10-15. My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale. https://arxiv.org/abs/2610.22301

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Bitcoin: A Non-Continuous Time System

Bitcoin has no shared global clock. Each node sees the network from its own place and at its own time. The same block may arrive at different moments, and different blocks may briefly appear at the same historical position. Yet a common history still emerges. We describe this process as a non-continuous time system (NCTS), in which the protocol state $S_h=(C_h,U_h)$ is assigned the historical coordinate $τ(S_h)=h$. This coordinate does not measure how much physical time has passed. It marks where a state belongs in the history that later states can inherit. In this framework, history advances through accepted state transitions rather than through the passage of physical time. We examine three complementary aspects of this structure. At a fixed observation point, block arrivals occur at irregular physical intervals. Across monitors, the same block is observed at different physical times. Fork data further show that competing blocks may temporarily occupy the same historical height. Taken together, these observations support the distinction between physical observation time and the historical coordinate of the inherited state sequence. The inherited past becomes increasingly stable, while the next continuation remains open to permissionless competition. Bitcoin moves forward without a shared present by inheriting a shared past.

cs.CR↗
arXiv2026

GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement

Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package dependency chain. These attacks are especially concerning for the Go language ecosystem, which is extensively used in critical cloud infrastructures. We present GoLeash, a novel system that applies the principle of least privilege at the package-level granularity, by enforcing distinct security policies for each package in the supply chain. This finer granularity enables GoLeash to detect malicious packages more precisely than traditional sandboxing that handles security policies at process- or container-level. Moreover, GoLeash remains effective under obfuscation, can overcome the limitations of static analysis, and incurs acceptable runtime overhead.

cs.CR↗
arXiv2026

An Empirical Analysis of EOS Blockchain: Architecture, Contract, and Security

With the rapid development of blockchain technology, various blockchain systems are exhibiting vitality and potential. As a representative of Blockchain 3.0, the EOS blockchain has been regarded as a strong competitor to Ethereum. Nevertheless, compared with Bitcoin and Ethereum, academic research and in-depth analyses of EOS remain scarce. To address this gap, this study conducts a comprehensive investigation of the EOS blockchain from five key dimensions: system architecture, decentralization, performance, smart contracts, and behavioral security. The architectural analysis focuses on six core components of the EOS system, detailing their functionalities and operational workflows. The decentralization and performance evaluations, based on data from the XBlock data-sharing platform, reveal several critical issues: low account activity, limited participation in the supernode election process, minimal variation in the set of block producers, and a substantial gap between actual throughput and the claimed million-level performance. Five types of contract vulnerabilities are identified in the smart contract dimension, and four mainstream vulnerability detection platforms are introduced and comparatively analyzed. In terms of behavioral security, four real-world attacks targeting the structural characteristics of EOS are summarized. This study contributes to the ongoing development of the EOS blockchain and provides valuable insights for enhancing the security and regulatory mechanisms of blockchain ecosystems.

cs.CR↗