Cross-server data flow

What mcp-scan saw

For each tool in this server, the data-flow scanner lowercased the tool name, description, and inputSchema properties JSON, then checked whether that string contains the lowercased config key of any other active server in the same scan. It is a plain substring test with no word boundary.

Why it fires

Two servers that reference each other can move data between trust boundaries the operator never drew. The scanner cannot observe calls, so it uses the only available proxy: one server's tool text naming another server. The check runs per tool, so a server with ten tools that each mention another server's name produces ten findings.

When this is a false positive

• MCP config keys are ordinary words: memory, git, fetch, time, search, filesystem. Any tool description containing the word 'time' is reported as a flow to a server keyed 'time', because there is no word-boundary check.
• It is substring matching, so a two-letter or three-letter config key matches inside longer words. A server keyed 'db' matches every description containing the letters db in sequence.
• The check runs inside the per-tool loop, so the same pair reports once per tool rather than once per server pair. A count of twelve findings can be one relationship.
• A description that merely documents interoperability, for example 'output can be piped into the filesystem server', matches without any actual coupling in code.

How to fix it

1. Read which two servers the finding names. If one of them is keyed with a common English word, check whether the match is that word appearing in prose.
2. Rename short or generic config keys to something distinctive, for example changing 'time' to 'time-mcp'. That removes the accidental matches and costs nothing.
3. For a real coupling, confirm the two servers are meant to share data and that the more privileged one is not reachable through the less privileged one.
4. Reword tool descriptions that only mention another server for documentation purposes.
5. To suppress, add 'cross-server-flow' to suppressRules in .mcp-scan.json.