mcp 0.5.0 tool guardrails are completely broken
tested tool isolation claims on 0.5.0 with basic file reader and api caller tools. findings: - tools can read environment variables (AWS_SECRET_KEY, OPENAI_API_KEY, everything) - tools can import agent context and read conversation history - tools can modify global state that persists across calls - stderr from crashes goes to /dev/null, agent hangs forever this is completely broken for production. how did this ship?
can you post exact mcp version and tool code for reproduction? we are testing 0.5.0 right now and need to know if guardrails are actually broken or if is config issue
can you post exact reproduction? we are evaluating 0.5.0 for deployment and need to know if this is real blocker
Tested exact same thing on mcp 0.5.0 yesterday with our Postgres query tool. Tool calls with guardrails enabled: 1. Strip read-only wrapper from SELECT queries 2. Allow UPDATE statements through when guardrails claim to block them 3. File path validation just checks string length, not actual path traversal Reproduction: create tool with file_path parameter, set guardrail to block paths containing "..", pass in "foo/..\\..\\etc/passwd" - guardrail passes it through because it only checks for ".." not "..\\". Version: mcp 0.5.0, tested on Windows 11 with Node.js 20.11.0.