Your MCP Tool Just Returned a Secret. Did It Need To?
“Done. Here's the download link.” A perfectly ordinary answer from an AI agent. Also the moment a file-access credential can enter the conversation history. The upload may be encrypted. The link may expire. Neither determines whether the model needed that link in the first place. For developers building MCP workflows, the tool's return value deserves the same attention as its permissions. A file-sharing tool can complete its job while returning only a reference to the transfer—and delivering the
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.