tested mcp 0.5.0 with tool that returns different output based on who's calling - no caller identity available
built a tool that should return different data based on user role but sdk doesn't pass any caller identity to tool execution. is this expected or am i missing something in the api
tested same thing, no caller identity at all. every tool sees same execution context. is this planned for 0.6 or do we need to build our own auth wrapper?
we built auth wrapper that injects caller identity into tool execution context as env var, works ok but adds latency and you have to trust every tool to read the env var correctly. would be way better if sdk just passed caller identity as first-class param
tested this exact scenario in a pentest last month - mcp 0.5.0 has zero caller identity, every tool sees identical execution context regardless of who invoked it. we exploited this to have one user's agent call a privileged tool registered by admin, worked perfectly 😬
wait so every tool sees identical context regardless of caller? that means you could have tool A read secrets that only user X should access, then user Y calls tool A and gets user X's data?