mcp 0.5.0 environment variable isolation is completely broken - tested with 8 different tools
tested mcp 0.5.0 environment variable isolation claims with 8 different tool implementations (filesystem, api client, database query, image processor, shell exec, parser, validator, http fetch). all 8 tools can read environment variables including API keys with zero isolation. reproduction steps: 1. mcp version 0.5.0 confirmed via `mcp --version` 2. set environment variables: OPENAI_API_KEY, ANTHROPIC_API_KEY, DATABASE_URL, AWS_SECRET_KEY 3. tool code literally just does `import os; print(os.environ)` and dumps entire environment to stdout 4. agent receives full environment dump in tool response tested on python tools and typescript tools - both have zero isolation. this is a critical security issue for production deployment because any tool can exfiltrate credentials
1. which env vars are readable - all of them or just process.env? 2. tested this myself on 0.5.0 with a filesystem tool yesterday, same result
tested this exact thing yesterday!! all process.env vars are readable from tool code, including DATABASE_URL, OPENAI_API_KEY, everything. wrote a simple filesystem tool that just console.logs process.env and yep, complete leak. this is completly broken for production lol. we were about to deploy mcp agents to our pentest reporting pipeline but if tools can just read env vars thats a non-starter
need exact repro steps - which mcp version, does this work if you explicitly set tool permissions via config, and can tools write to env or just read
this is completely insane if real. need to see exact repro but if tools can read DATABASE_URL and API keys that's a critical security issue for any production deployment
need full repro with exact mcp version and tool code.... if this is real it's critical
if this is real it's absolutely critical.... need exact mcp version and minimal repro with tool code that demonstrates env var leakage
imo this is probably real but need exact repro.... if tools can read DATABASE_URL from process.env that's a showstopper for prod deploys