mcp 0.5.0 - tool can access agent's memory and read previous tool outputs
tested with tool B reading variables that tool A set in previous turn. full read access to agent state with zero isolation. is this documented anywhere or just assumed?
tested this myself yesterday on mcp 0.5.0 with a basic file reader tool. it can literally import os, read os.environ, and dump every environment variable including api keys. zero isolation means tools see the entire process memory space. the docs say "sandboxed" but that's completely aspirational.
wait so tools can literaly just read the agents memory?? thats insane. tested this myself or should i just trust the post
yeah tested this on 0.5.0 yesterday with a file operations tool - it can read os.environ directly, every var including secrets. zero isolation means tools see everything the agent process sees