MCP-FSD validates filesystem access outside tools’ advertised scope

A public MCP registry entry can advertise a harmless-looking tool while its server process holds filesystem privileges beyond that advertised function. MCP-FSD analyzes this gap as an implementation and execution-boundary problem, not just a language-model prompt problem. Its screening pipeline starts with 21,097 listings across nine registries, narrows to 4,806 classified entries and flags 787 potential filesystem-capability mismatches. This screening fraction is not the prevalence of exploitable production services.

The researchers executed a selected runnable population in isolated environments containing planted credential markers. They confirmed 150 out-of-scope filesystem effects; in 136, tool results returned the exact synthetic secret. The other 14 showed other boundary violations. Most cases required only direct path arguments, but some involved structured documentation or configuration. These are reproducible tool effects under test conditions. They do not establish that 136 real customers lost keys or that every finding was triggered by an autonomous agent in deployment.

Git MCP staging provides a specific path-normalization example, while other servers fail at different filesystem interfaces. Tool registration, schema type checking, the model's permissions and the server process's underlying OS rights are distinct layers. The required test is whether the final resolved file actually belongs to the approved workspace, including cases where a library, operating system or symlink resolution changes the meaning of the original argument. Restricting the server identity provides a separate containment check if application-level validation is bypassed.