Stopping a Filesystem MCP Server From Reading .env Files

说明与用途

Agentgateway 的文件系统 MCP 由于其内置策略无法检查路径参数，可能会读取 .env 及其他凭证文件。通过 ExtMCP 添加外部策略服务器，可在路径上进行检查并阻止读取凭证文件，从而防止秘密泄露。

问题

A filesystem MCP server scoped to a directory still reads .env and other credential files if an agent requests them by path, exposing secrets.

结果

The guardrail successfully blocks reads of credential‑bearing files, as demonstrated by a rejected read of /sandbox/.env and an allowed read of the same file without the guardrail.

工作流

• 1. Configure agentgateway with an mcpGuardrails policy pointing to a remote policy server.
• 2. The policy server implements CheckRequest to parse tool name and arguments.
• 3. For path‑bearing tools, the server checks each path against a denylist (e.g., .env, .ssh, .git/).
• 4. If a match is found, the server returns an AuthorizationError, causing the filesystem server to refuse the read.
• 5. The agent receives an error instead of file contents.

证据

Agentgateway has a built‑in MCP authorization policy: mcpAuthorization, CEL rules evaluated against mcp.tool.name, mcp.tool.target, and JWT claims like jwt.sub when authentication is configured.

来源

The server is about 150 lines of Python. CheckRequest parses the JSON‑RPC params, pulls name and arguments, and for path‑bearing tools checks every path string against a denylist.

来源

A match returns an AuthorizationError from CheckRequest, and the filesystem server never opens the file: … error code "error" message "path argument matches denied pattern '.env'; filesystem-mcp-env-guard blocks reads of credential-bearing paths"

来源