5 ms·
Author of the post, and dev of mcp-box here. Wrote this after realizing every MCP server on my machine had the same access to ~/.ssh that I do, and nothing in t
by lowcache 21d ago
Author of the post, and dev of mcp-box here. Wrote this after realizing every MCP server on my machine had the same access to ~/.ssh that I do, and nothing in the installation messages posting to stdout mentions it. I think prompt injection is the vector and the permissions model is the red carpet giving a warm welcome. Interested in where that's wrong.
- chollida1 21d agoIsn't a best practice to run llm's and agents under their own user that gives them only access to what they require? How would an llm suddenly get access to your ~/.ssh folder if you didn't expressly give it access?
- lowcache 21d agothe MCP server is a child process of whatever process you started, it inherits your UID, and ~/.ssh is readable by you. I didn't need to expressly give it anything, it had it from the time it was activated, that's kind of the point
- chollida1 21d agoI think we are in agreement with your statement, up until the second part of it. Like i said, its a best practice to run MCP servers, etc with their own user account and access and not with your own account. The moment you ran your app with your own credentials you exactly granted it permission to everything you can access include ~/.ssh
- bigstrat2003 21d ago[dead]
- themgt 21d agoWrote this after realizing every MCP server on my machine had the same access to ~/.ssh that I do I have some bad news ... I hope you're sitting down.