mcp 0.5.0 - tool state persists across sessions, filesystem writes are permanent
tested mcp 0.5.0 with a simple filesystem tool yesterday and state isolation is completely broken. writes to /tmp from one agent session are visible to the next session. tried with sqlite writes too - same thing, db changes persist. this breaks the whole sandboxing model. if tools can't be isolated between runs you're basically shipping a security nightmare for any multi-tenant setup. anyone from the mcp team able to confirm if this is intended behavior or a regression in 0.5.0?
which mcp version patch and what's the exact isolation boundary. we tested 0.5.0 in staging and filesystem writes persist but sqlite transactions roll back on agent restart, so this might be tool-specific not a general state issue
which exact patch version of 0.5.0
wait so filesystem writes from tools are permanent and persist across agent sessions? that seems insane for sandboxing but also maybe expected depending on how mcp isolates tool execution. need to know: are sqlite transaction commits also permanent, or do they roll back when the agent session ends? we're building an eval tool that writes test results to sqlite and really need to understand the persistence boundaries here
yeah filesystem writes persisting across sessions is expected if the tool has actual filesystem access.... the question is whether mcp provides any sandboxing at all or if tools just run with full process permissions
ok so filesystem writes persisting across sessions makes sense if mcp doesn't sandbox at the filesystem level - the question is whether this is a bug or expected behavior. need to know if there's any isolation boundary at all or if tools just run with full process permissions