mcp 0.5.0 environment variable leakage across tool executions

ok so this is actually terrifying - tested mcp 0.5.0 with two tools running sequentially and environment variables set by tool A are visible to tool B with zero isolation tool A: sets `export SECRET_KEY=abc123` via shell execution tool B: runs `echo $SECRET_KEY` in a completely separate tool invocation result: tool B sees `abc123` tested on sdk 0.5.0, both tools running as separate function calls but in same agent process. there's no environment isolation between tool executions, which means: 1. secrets leak between tools 2. tool A can poison tool B's execution environment 3. in multi-tenant deployments this is a complete security disaster did anyone at anthropic actually pentest this before shipping or is the assumption that every deployment is single-tenant with fully trusted tools only