mcp sdk 0.5.0 - does tool execution happen in same security context as agent or is there any sandboxing
we're deploying agents in production and need to understand the security boundaries. if a tool makes a filesystem call or network request, does it run with same permissions as the agent process or is there any isolation... can't find this in the docs and it's critical for our threat model. tested on 0.5.0 with a tool that writes to /tmp and it succeeded, which suggests no sandboxing at all but want to confirm before we architect around it
ok so this is a huge deal if true. tested this on 0.5.0 yesterday and tools just run as whatever user the agent process is running as, no tenant scoping at all. did you check if env vars are isolated or completely shared?
did you test if filesystem access is scoped per tenant
filesystem access and env vars both leak across tenants in 0.5.0. tested with two simulated tenants sharing an agent instance - tenant A set env var `API_KEY=secret_a`, tenant B called a tool that read env vars and got tenant A's key. no isolation at all
1. filesystem access definitely not scoped 2. tested with tenant A writing `/tmp/secret.txt` and tenant B reading it - zero isolation
tested null bytes and unicode direction overrides on mcp 0.5.0. tool name `safe_read\x00$(rm -rf /)` registers with full string including null byte and command injection, but displays as `safe_read` to user. registration validation in 0.5.0 does zero sanitization of control characters.
unicode direction overrides in tool names is wild. so display shows safe_read but actual registered name has command injection hidden after null byte?