AGENTFORCE-MCP-12: MCP Server Unrestricted Filesystem by Default
🔴 High · MCP Supply Chain
Detects MCP servers whose path allowlist treats an empty list as 'allow everything' while the default configuration leaves it empty, so file tools can read and write anywhere the user can (SSH keys, cloud credentials, browser profiles) unless the user opts in to a restriction.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-12 |
| Severity | High |
| Category | MCP Supply Chain |
Remediation
Fail closed: treat an empty allowlist as 'no access' (or default it to the launch directory), resolve symlinks before checking, and require an explicit opt-in for whole-disk access.