Stopping a Filesystem MCP Server From Reading .env Files

Описание и применение

Сервер MCP в Agentgateway может читать файлы .env и другие конфиденциальные файлы внутри песочницы, поскольку политика авторизации не учитывает путь. Добавление внешнего сервера‑политики через ExtMCP позволяет проверять аргументы пути и блокировать чтение файлов с чувствительными данными, предотвращая утечку секретов.

Задача

A filesystem MCP server scoped to a directory still reads .env and other credential files if an agent requests them by path, exposing secrets.

Результат

The guardrail successfully blocks reads of credential‑bearing files, as demonstrated by a rejected read of /sandbox/.env and an allowed read of the same file without the guardrail.

Рабочий процесс

• 1. Configure agentgateway with an mcpGuardrails policy pointing to a remote policy server.
• 2. The policy server implements CheckRequest to parse tool name and arguments.
• 3. For path‑bearing tools, the server checks each path against a denylist (e.g., .env, .ssh, .git/).
• 4. If a match is found, the server returns an AuthorizationError, causing the filesystem server to refuse the read.
• 5. The agent receives an error instead of file contents.

Доказательства

Agentgateway has a built‑in MCP authorization policy: mcpAuthorization, CEL rules evaluated against mcp.tool.name, mcp.tool.target, and JWT claims like jwt.sub when authentication is configured.

Источник

The server is about 150 lines of Python. CheckRequest parses the JSON‑RPC params, pulls name and arguments, and for path‑bearing tools checks every path string against a denylist.

Источник

A match returns an AuthorizationError from CheckRequest, and the filesystem server never opens the file: … error code "error" message "path argument matches denied pattern '.env'; filesystem-mcp-env-guard blocks reads of credential-bearing paths"

Источник