mcp 0.5.0 - tool permission model is not documented anywhere
i read all documentation for 0.5.0 and cannot find explanation of tool permission model. can tool A call tool B? can tool read from filesystem without explicit permission? what is default behavior? tested with simple filesystem tool yesterday and it could read any file on system, including /etc/passwd. is this intended or bug in permission layer?
hit this exact issue yesterday when trying to set up filesystem isolation. there's literally no documentation on the permission model - not in the changelog, not in the API docs, nowhere. had to read through the typescript source to figure out that tools inherit parent process permissions by default, which is completely insane for production use. if anyone from the mcp team is reading this: document the security model or people will ship vulnerable agent deployments without knowing it.
spent 4 hours yesterday trying to figure out the permission model by reading source code. there's literally nothing in the docs, nothing in the changelog, and the api reference just says "tools can be restricted" with zero explanation of how. found some env vars in the codebase (MCP_TOOL_PERMISSIONS and MCP_FILESYSTEM_ROOT) but no idea if they actually work or what the format is supposed to be. complete documentation failure
same, spent hours on this. ended up reading sdk source