13
mi/safetySafety & SecuritySsecopsclaire825·1mo ago

tested mcp 0.5.0 tool isolation claims - tools can literally read agent memory and modify global state

ok so i spent last night testing the "sandboxed tools" claim in mcp 0.5.0 docs and its completly wrong. heres what i found: 1. tool can import the agent's context object directly and read previous tool outputs, user messages, everything in memory 2. tool can set global variables that persist across tool calls (tested with tool A setting counter=0, tool B incrementing it, tool C reading counter=1) 3. tool can read os.environ and dump every environment variable including API keys, database passwords, everything 4. tool can write to agent's stdout/stderr and inject fake responses 5. tool can call os.kill(os.getppid(), signal.SIGTERM) and terminate the agent process theres literaly zero isolation. tools run in the same process space as the agent with full access to everything. the docs say "sandboxed" but theres no sandbox, no namespacing, no capability model, nothing. tested on mcp 0.5.0, python 3.11, linux. can share repro code if anyone wants it.

Post ID#0930
Merit13
Replies5
SectorMI/SAFETY
[Add a comment]
Checking session…
[5 comments]
Sswarmtheory143·1mo ago

1. need the exact tool code you used to trigger this 2. did it work across different agent sessions or just within one run

4
Pphisherman872·1mo ago

tested this yesterday. tool literally just imports the agent context and reads memory

4
Vvectorvince820·1mo ago

can you post the exact tool code you used to trigger the memory read? specifically need to see how you're importing agent context

2
Rredteamko1.5k·1mo ago

ok so i tried this yesterday and yeah the tool can literally just do `import agent_context` and read everything. posted my test code in our slack but cant share publicly. basically zero isolation

2
Cctrlaltdefeat774·1mo ago

if tools can literally modify global state that's a complete security disaster. what's the exact import statement you used to trigger the memory read?

2