# MCP-FSD: 150 MCP servers read files outside their declared scope

> MCP-FSD measures how often an MCP server's code can read host files that its tool descriptions never declare.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Supply chain
- **Published by:** arXiv
- **Disclosed:** 2026-10-15
- **Affects:** MCP servers, mcp-server-git
- **Research by:** Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun, Pengzhou He
- **Primary source:** https://arxiv.org/abs/2610.22301
- **Page:** https://theinjection.dev/items/arxiv-mcp-filesystem-capability-laundering/

One in six MCP servers that carry no filesystem classification can still reach the host filesystem, five authors report after cataloguing 21,097 servers from nine registries. Paired dynamic tests confirmed 150 vulnerable instances.

## What happened

Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun and Pengzhou He posted the MCP-FSD study to arXiv on October 15, 2026. The authors catalogued 21,097 MCP servers from nine registries, then tested a triaged subset for filesystem access wider than each tool declares. Coordinated disclosure produced 13 security advisories, the authors say, including two CVEs in Anthropic's Git MCP Server.

## How it works

The authors name the pattern filesystem capability laundering: a server advertises non-filesystem tools, yet its implementation passes attacker-controlled arguments into file operations that reach whatever the server process can read. MCP-FSD infers a least-privilege path boundary for each tool, plants credential files outside that boundary, then runs paired executions to see whether a tool reads them and whether the sandbox stops it. Bypassable path validation is treated as a third analysis layer, after server-category screening and per-tool contract analysis.

## Who is affected

Teams that install MCP servers from public registries are the audience, in particular anyone who leaves a server with the host filesystem it inherits. The authors report 787 of 4,806 triaged servers, 16.4%, holding filesystem capabilities despite a non-filesystem classification. All figures come from the authors' own scanning pipeline, not from reported incidents.

## What to do

Treat an MCP server's declared tool category as a label rather than a boundary, and run each server under a sandbox limited to the paths its job needs. One case the authors cite, CVE-2026-27735 in mcp-server-git, is fixed in version 2026.1.14.

## Quick facts

- **arXiv v1:** October 15, 2026
- **Servers catalogued:** 21,097 from nine registries
- **Off-contract access:** 787 of 4,806 triaged servers, 16.4%
- **Confirmed vulnerable:** 150 instances under the sandbox policies tested
- **Disclosure:** 13 advisories and two CVEs in Anthropic's Git MCP Server, per the authors
- **Verified case:** CVE-2026-27735, git_add path traversal, fixed in mcp-server-git 2026.1.14
- **Code:** No repository linked on the arXiv page

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.22301)
2. [Git MCP Advisory](https://github.com/advisories/GHSA-vjqx-cfc4-9h6v)
3. [Author Case Study](https://oddguan.com/blog/anthropic-mcp-server-git-add-path-traversal-credential-exfiltration-capability-laundering-cve-2026-27735/)