MCP-FSD: 150 MCP servers read files outside their declared scope
MCP-FSD measures how often an MCP server's code can read host files that its tool descriptions never declare.
· arXiv · Research by Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun, Pengzhou He
One in six MCP servers that carry no filesystem classification can still reach the host filesystem, five authors report after cataloguing 21,097 servers from nine registries. Paired dynamic tests confirmed 150 vulnerable instances.
01What happened
Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun and Pengzhou He posted the MCP-FSD study to arXiv on October 15, 2026. The authors catalogued 21,097 MCP servers from nine registries, then tested a triaged subset for filesystem access wider than each tool declares. Coordinated disclosure produced 13 security advisories, the authors say, including two CVEs in Anthropic's Git MCP Server.
02How it works
The authors name the pattern filesystem capability laundering: a server advertises non-filesystem tools, yet its implementation passes attacker-controlled arguments into file operations that reach whatever the server process can read. MCP-FSD infers a least-privilege path boundary for each tool, plants credential files outside that boundary, then runs paired executions to see whether a tool reads them and whether the sandbox stops it. Bypassable path validation is treated as a third analysis layer, after server-category screening and per-tool contract analysis.
03Who is affected
Teams that install MCP servers from public registries are the audience, in particular anyone who leaves a server with the host filesystem it inherits. The authors report 787 of 4,806 triaged servers, 16.4%, holding filesystem capabilities despite a non-filesystem classification. All figures come from the authors' own scanning pipeline, not from reported incidents.
04What to do
Treat an MCP server's declared tool category as a label rather than a boundary, and run each server under a sandbox limited to the paths its job needs. One case the authors cite, CVE-2026-27735 in mcp-server-git, is fixed in version 2026.1.14.
Sources 3 links, all fetched
- 1arxiv.orgarXiv Paper
- 2github.comGit MCP Advisory
- 3oddguan.comAuthor Case Study