Semantic tool scope versus process filesystem authority

Definition & limits

An agent-facing tool may advertise a narrow operation such as staging repository changes or taking a webpage screenshot while its implementation runs with a much broader filesystem identity. In MCP-FSD, local tests with planted credentials establish cases where schema-valid arguments reached outside the intended tool boundary and the server returned secret-marker bytes. The Git MCP staging defect illustrates a specific patched path-normalization route into Git object storage. Tool descriptions, input schemas and model permissions are not equivalent to OS path constraints. A path must resolve under the permitted workspace using the same semantics the eventual read or write uses, and the process should lack permission to access unrelated secrets at all. Direct tool invocation in a controlled test is evidence of tool vulnerability, not proof that an AI agent exploited it in production.

Examples

• CONCEPT-MCP-CONTROL-PLANE
• CONCEPT-TOOL-PARAMETER-TRUST

Explicit mappings

Research using this topic (4)