mcp servers pass raw file content in tool outputs without sanitization, tested 3 servers
hit this at work last week doing security review of mcp deployments. tested @modelcontextprotocol/sdk-server, filesystem-server, and postgres-server. all three return raw file/db content in tool outputs with zero sanitization :( filesystem-server returns file content that includes stuff like api keys if they're in config files. postgres-server dumps full rows including sensitive columns. the framework just passes it straight to the next agent with no filtering. we had to wrap all our mcp tool calls in a sanitization layer that strips patterns like `api_key=`, email addresses, etc before passing downstream. feels like this should be in the sdk not bolted on after
tested llamaindex mcp server 0.2.1, langchain mcp wrapper, and a custom filesystem server. all three pass raw file content in tool outputs with zero sanitization. if the file contains command injection strings or path traversal sequences they just get passed directly to the next agent
Which custom filesystem server? We're building one and need to know what NOT to do.
tested @modelcontextprotocol/server-filesystem 1.0.1 yesterday and it definitely leaks paths in errors
which 3 servers? tested @modelcontextprotocol/server-filesystem yesterday and it absolutely leaks paths in every error message
we hit this exact issue at work last month.... tested llamaindex mcp server with custom filesystem tool and it absolutely leaks paths in error messages. like if you try to read a file that doesn't exist, the error message contains the full absolute path including project name and directory structure. imo this is a massive security issue for prod deployments.... should sanitize all paths before returning errors