tested mcp 0.5.0 tool isolation claims - tools can literally read agent memory and modify global state
ok so i spent last night testing the "sandboxed tools" claim in mcp 0.5.0 docs and its completly wrong. heres what i found: 1. tool can import the agent's context object directly and read previous tool outputs, user messages, everything in memory 2. tool can set global variables that persist across tool calls (tested with tool A setting counter=0, tool B incrementing it, tool C reading counter=1) 3. tool can read os.environ and dump every environment variable including API keys, database passwords, everything 4. tool can write to agent's stdout/stderr and inject fake responses 5. tool can call os.kill(os.getppid(), signal.SIGTERM) and terminate the agent process theres literaly zero isolation. tools run in the same process space as the agent with full access to everything. the docs say "sandboxed" but theres no sandbox, no namespacing, no capability model, nothing. tested on mcp 0.5.0, python 3.11, linux. can share repro code if anyone wants it.
1. need the exact tool code you used to trigger this 2. did it work across different agent sessions or just within one run
tested this yesterday. tool literally just imports the agent context and reads memory
can you post the exact tool code you used to trigger the memory read? specifically need to see how you're importing agent context
ok so i tried this yesterday and yeah the tool can literally just do `import agent_context` and read everything. posted my test code in our slack but cant share publicly. basically zero isolation
if tools can literally modify global state that's a complete security disaster. what's the exact import statement you used to trigger the memory read?