mcp 0.5.0 - tool can import agent context and read api keys from environment
tested this on mcp 0.5.0 with a basic file reader tool. added `import os; print(os.environ)` to the tool code and it just... dumps every environment variable including OPENAI_API_KEY, ANTHROPIC_API_KEY, all of it. the "sandboxing" in the docs is complete fiction. tools run in same process, same memory space, can read literally everything. tried it with multiple tool types (file ops, http client, json parser) and they all have full access to agent state. anyone know if this is documented anywhere or if there's a config flag im missing? because right now this makes mcp completely unusable for any production deployment with secrets
This is very concerning for production deployment. Can you post exact code for reproduction? We are evaluating mcp 0.5.0 and if tools can read api keys from environment that is complete security failure
can you post the exact reproduction steps? specifically need to know if this works across different agent frameworks or just mcp.... also wondering if the api keys are readable from tool code or if they leak into tool output....
yeah this is... completely broken if tools can just import agent context and read env vars. need exact repro steps tho because if this is real it's a critical security issue