The scope was never shown — a scan of 21,097 MCP servers confirms 150 that read credentials outside their declared contract, and the AI Act article you reach for excludes open-source tools anyway

MCP-FSD catalogued 21,097 MCP servers across nine registries and triaged 4,806 of them; 787 of the triaged servers (16.4%) exhibited filesystem capabilities despite carrying non-filesystem functional classifications.

Why it mattersThe denominator is the triaged set, not the catalogue. Quoting 16.4% of 21,097 would overstate the population by more than four times.

arxiv2026mcpfsd · arxivexport2026record

The authors characterise the 16.4% category mismatch as a coarse initial screening signal rather than a definitive violation metric, because no external ground-truth labels exist across the catalogue.

Why it mattersThis is the figure most likely to be lifted as a vulnerability rate. The authors disclaim it themselves, so repeating it as one is a misquote, not an interpretation.

arxiv2026mcpfsd

Three-case dynamic validation confirmed 150 vulnerable instances; for 136 of the 150 the adjudication relied on exact credential-marker matching, and for the remaining 14 on other transcript evidence such as write side-effects or response-shape changes.

Why it matters150 is the number that survives execution. It is the one to cite.

arxiv2026mcpfsd

Coordinated disclosure produced 13 reports, two of which became CVEs in Anthropic's Git MCP Server; both CVEs were patched upstream before the paper appeared.

Why it mattersThe CVEs are not new findings from last week. The news is the scan, not the bugs.

arxiv2026mcpfsd · nvd2025unscoped · nvd2026pathtrave

CVE-2025-68143: in mcp-server-git before 2025.9.25 the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location, making those directories eligible for subsequent git operations; the tool was removed entirely rather than fixed.

Why it mattersThe remediation was deletion. A tool whose declared scope cannot be enforced is not always fixable in place.

nvd2025unscoped

CVE-2026-27735: in mcp-server-git before 2026.1.14 the git_add tool did not validate that paths in the files argument lay inside the repository, and because it used GitPython's repo.index.add() rather than the Git CLI, relative paths containing ../ were accepted and staged.

Why it mattersPin mcp-server-git to 2026.1.14 or newer. The library choice, not the agent, is what admitted the traversal.

nvd2026pathtrave

In typical local MCP deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation; the declared contract of name, description and argument schema is not an enforcement boundary.

Why it mattersThis is the mechanism. No injection is required, so prompt-level defences do not reach it.

arxiv2026mcpfsd

At the sink level 54.3% of static emissions are Node-ecosystem files and 42.6% Python; Python leads the PT-001 missing-validation rule with a 53.8% within-rule share while Node leads every bypass-style rule at 57% to 63%, which the authors attribute to the MCP TypeScript SDK shipping no built-in path-containment check.

Why it mattersThe gap is ecosystem-structural. If your servers are Node, the containment check is yours to write.

arxiv2026mcpfsd

The paper reports that operating-system process isolation reliably enforced the inferred least-privilege boundaries in its three-case validation without disrupting benign tool functionality.

Why it mattersThe control that worked is the one you can deploy today, without a protocol change or a vendor fix.

arxiv2026mcpfsd

AI Act Article 25 operates only within the high-risk regime, and Article 25(4)'s written-agreement duty for supplied tools, services, components and processes expressly does not apply to publicly accessible tools, services, processes or components other than general-purpose AI models released under a free and open-source licence.

Why it mattersThe value-chain reflex misses twice over: the regime is deferred, and the carve-out covers most of the MCP ecosystem even once it arrives.

euartificia2024responsib

GDPR Article 25(2) requires that by default only personal data necessary for each specific purpose are processed, and the obligation extends to the amount collected, the extent of processing, the storage period and their accessibility.

Why it mattersThe accessibility limb is what reaches a default local configuration. It is a duty on the controller's own defaults, not on the supplier's contract.

gdprinfoeu2026data

Independent corroboration: in 23 controlled local validations reported on 16 October 2026, the original configuration reached the approval-token transition in 9 of 9 reruns and completed the exact target operation in 8 of 9, evidencing an authorization-context gap in which token possession is treated as sufficient authorization even where resource scope is not jointly enforced.

Why it mattersA case study in one competition environment, not a population estimate. It corroborates the mechanism from the authorization side.

arxiv2026authoriza

The NVD record scores the same git_init flaw at CVSS v3.1 base 8.8 HIGH and CVSS v4.0 base 6.5 MEDIUM.

Why it mattersWhich severity a dashboard shows depends on the scoring version the scanner speaks, not on the behaviour of the bug.

nvd2025unscoped

Author affiliations for arXiv:2610.22301, taken from the work's own front matter, are the University of Illinois Urbana-Champaign, Santa Clara University, Auburn University at Montgomery, and two independent researchers.

Why it mattersNo single institution sponsors the scan; the registry-coverage claim rests on the method, not on an affiliation.

arxiv2026mcpfsd

The scan's dynamic results are conditional on servers the pipeline could install and run, the paper does not measure the accuracy of its own inferred least-privilege boundaries, and a boundary inferred too tightly can flag legitimate access.

Why it mattersThe limitation is the authors' own. It caps how far 150 can be generalised.

arxiv2026mcpfsd