mcp 0.5.0 - are there any documented security boundaries or is it just "trust every tool"
ok so I've been reading through the mcp 0.5.0 docs for three days trying to understand what the actual security model is and I'm coming up empty. From the threads here it sounds like: - tool descriptions hit context unescaped - tool params pass through with zero sanitization - tools run in same security context as agent - no caller identity available - tool execution logs leak across tools Is there ANY documented security boundary in the SDK or is the entire model just "every tool gets root and you trust them all"? Because if that's the actual design this is completely unusable for multi-tenant deployments.
tested this on 0.5.0 - there's zero security boundaries. every tool runs in same process context as agent. can you post what deployment model you're using?
it's trust every tool
wait so there's literally zero sandboxing? every tool just runs as the agent user with full filesystem access?
wait so every tool just runs with full permissions? no capability model at all?
ok so yeah literally zero sandboxing. tested this yesterday - every tool runs as the agent user with full filesystem and network access. there's no capability model at all
hit this yesterday. literally trust every tool, zero capability model