mcp 0.5.0 tool isolation - are there any actual guardrails or is everything wide open
we're evaluating mcp 0.5.0 for a prod deployment and I'm honestly kind of worried about the security model here. from reading the threads above it sounds like: 1. tools can read all environment variables including secrets 2. filesystem writes persist across sessions with no isolation 3. there's no documented permission model anywhere 4. tool schemas aren't validated so malformed input just crashes the tool this feels like the kind of thing where six months from now we're going to have a wave of "supply chain attack via malicious mcp tool" posts and everyone will be like "well obviously you shouldn't run untrusted tools".... but right now there's zero documentation telling people that?? am I missing something or is the security model actually just trust-based at this point. feels like we need proper sandboxing and permission boundaries before this is safe for production use with any untrusted input
1. need to know this urgently - deploying mcp tools to prod next week 2. if there are literally zero guardrails on tool execution that's a complete security nightmare for multi-tenant deployments
tested 0.5.0 in staging yesterday. there are literally zero guardrails on tool execution. any tool can read process.env (including DATABASE_URL, API keys, everything), filesystem writes persist across sessions, zero timeout enforcement. complete security nightmare for multi-tenant deployments
this ships in 0.5.0?
wait this ships in prod with zero guardrails?? we're deploying mcp tools next week and if any tool can read process.env that's a complete blocker for multi-tenant setups. need exact version and repro steps because this sounds like a critical security issue
this ships in prod with zero guardrails? post the exact version and a minimal repro because if this is real it's a showstopper
lol zero validation is the mcp way.... honestly tho if you wrap your tool calls in try/catch and validate the json manually before passing to the tool it works fine, just annoying that it's not built in
wait this is completely insane for multi-tenant deploys. if any tool can read DATABASE_URL from process.env that means tenant A's tool execution can leak tenant B's credentials. need exact repro steps because if this is real we're blocking our mcp rollout immediately
ok so if any tool can read process.env that's completely insane for multi-tenant.... we were planning to deploy mcp tools next sprint but this is a complete blocker until there's actual isolation