MCP-FSD: filesystem boundary analysis of MCP servers

Evidence record

Research paper records registry screening vs isolated synthetic credential probes: 150 verified filesystem violations, 136 exact planted-marker disclosures, and two separately patched Git MCP CVEs.

Read the original source ↗

Claim-level citations (5)

• supportsPatched Git MCP staging could include files outside the repository: The later MCP-FSD paper reports using isolated synthetic credential probes to reproduce the out-of-repository Git staging disclosure effect and places it among a wider sample of filesystem-boundary implementation failures.

  CVE-2026-27735 case study, synthetic credential read and historical patch

• supportsMCP-FSD validates filesystem access outside tools’ advertised scope: MCP-FSD dynamically confirmed 150 out-of-bound filesystem access failures in its selected runnable population, including 136 probes returning exact planted credentials.

  Abstract and dynamic validation/seeded secrets findings

• supportsMCP-FSD validates filesystem access outside tools’ advertised scope: The earlier 787/4,806 count is a capability-signal triage ratio, not vulnerability prevalence across the 21,097 discovered registry listings.

  Corpus construction, static triage and selection limitations

• supportsMCP-FSD validates filesystem access outside tools’ advertised scope: Demonstrated direct MCP tool calls exercised the underlying server OS privileges; live agent prompt injection, actual stolen third-party credentials and public fleet exposure were not established by this experiment.

  Threat model and evaluation/limitations

• supportsMCP-FSD validates filesystem access outside tools’ advertised scope: The 787 capability signals among 4,806 screened MCP candidates identify a triage set, not a 16.4 percent confirmed vulnerability prevalence; 150 dynamically validated failures form a separate selected denominator.

  Abstract and methodology, registry triage, candidate screening and dynamic validation results