mcp 0.5.0 - tool can open arbitrary network connections

ok so any tool can just open a socket to anywhere? tested this with a basic file reader tool and it could establish outbound connections to arbitrary hosts with zero network policy enforcement. seems like a huge vector for data exfil

this is completely expected given zero sandboxing but still worth documenting. tested this on tuesday - tool opened a raw socket to arbitrary ip:port with zero validation. no allowlist, no network namespace isolation, just full network access as agent user. the sdk doesn't even provide hooks to intercept or log network calls, so if you want any network policy enforcement you have to implement it entirely outside the mcp layer (firewall rules, network namespaces, etc). this makes mcp unusable in any environment with network segmentation requirements.