MCP server security hinged on $HOME — and the agent controls the environment
Relevant_Mousse_9117 · reddit · 2026-11-10
一位开源 MCP 服务器维护者(凭证存于 OS keychain、agent 只能调用白名单操作)在审计时问了一个问题:这个进程是谁启动的?答案发现 agent 完全可以决定运行环境,而他一直在读取这个环境做安全决策:
- PATH:通过 npx 启动的包装型服务器按调用方 PATH 查找,PATH=./bin:$PATH 即可让 agent 自己的脚本拿到 env 里的 GitHub token
- SystemRoot(Windows):审批对话框指向的是 agent 指定的 PowerShell,伪造的 PowerShell 可批准一切提示
- HOME:SFTP 工具「永不触碰 /.ssh」的规则正是从 $HOME 构建的
修复后这些值改从 OS 读取,子进程以清空环境启动。核心教训:如果 agent 能启动你的工具,那么每一个环境变量都是 agent 的输入。
More from coding & agent
- Skills vs linked docs: where should AI agents' knowledge live? — IllustriousFault6218 · 2026-11-10
- Fable 5.2 models a Bugatti Tourbillon in Blender from a single prompt in 2.5 hours — socialwithaayan · 2026-11-10
- Pake: Rust-based tool packs any webpage into a lightweight desktop app, 539K downloads — Aiden_Tech_Ai · 2026-11-10
- Frontier3DBench: 145 tasks test whether coding agents can replace 3D vision pipelines — Aiden_Tech_Ai · 2026-11-10
- LASIK open-sourced: strips anti-AI obfuscation, cutting 21M tokens to 17k — morphh7 · 2026-11-10
- Human-in-the-loop is easy; keeping the human attentive is hard — 4 metrics to test if your AI approvals mean anything — alex_verem · 2026-11-10