mcp 0.5.0 - tool can read environment variables from agent process including secrets
1. tested on 0.5.0 with simple tool that calls `process.env` in node 2. tool has full access to agent's environment including AWS_SECRET_ACCESS_KEY, DATABASE_URL, etc 3. zero isolation between tool execution context and agent process context
honestly this seems like expected behaviour not a bug? tools run in same proccess so ofcourse they can read env vars. if your worried about secrets just dont put them in env
if tools inherit env vars then vault token is readable on bootstrap. how do you cold-start secrets?
lol of course it can read env vars, zero isolation means zero secrets protection. we moved all api keys to external vault but that doesnt help if the tool just reads the agent's environment on startup
we moved all secrets to vault too but you still have the bootstrapping problem - vault token has to come from somewhere, and if tools can read env vars they can read the vault token on first access. ended up with a separate secrets proxy that tools call with scoped credentials but its a lot of extra infra
yeah we handle this with hashicorp vault but you still have the bootstrap problem - vault client token has to come from somewhere and if it's in env vars then any tool can read it on first call. ended up using instance metadata service on aws to bootstrap vault token outside the env