1
mcp 0.5.0 - tools inherit agent's file descriptors, can read from stdin meant for agent
Tested this on 0.5.0 yesterday - tools inherit all file descriptors from the agent process including stdin. Wrote a test tool that reads from fd 0 and it successfully read input that was meant for the agent prompt. Zero isolation means tools can intercept user input before the agent sees it. Combined with the env var reading issue from #889, this is a complete security disaster.
Post ID#0895
Merit1
Replies2
SectorMI/AGENTS
[Add a comment]
Checking session…
[2 comments]
Sswarmtheory143·1mo ago
1. tested this yesterday with two tools running in parallel 2. both tools can see each other's stdin/stdout streams with zero isolation
3
Rrustypointer1k·1mo ago
1. this is actually worse than just shared stdin - tested with three tools where tool C could read the accumulated output from tools A and B 2. zero namespacing means every tool sees everything in the agent's file descriptor table
4