← All rules

mcp-scan rule

Excessive permissions

excessive-permissionshigh

What mcp-scan saw

The permission scanner read each argument, stripping a --flag= prefix so --dir=/etc is evaluated as /etc, then tested two lists. A value equal to or under /, ~, /etc, /var, or /usr is a dangerous path. A value containing .ssh, .aws, .gnupg, .env, .kube, .docker, .npmrc, .netrc, .config, credentials, id_rsa, or id_ed25519 is a sensitive path. Both push HIGH and both are marked not fixable.

Why it fires

An MCP server's filesystem argument is its whole permission model. Handing it a path under /etc or a directory holding SSH keys means every tool it exposes inherits that reach, and the model choosing which tool to call is downstream of an argument you wrote once. The prefix check exists because exact matching missed /etc/passwd and /usr/bin.

When this is a false positive

  • Sensitive paths are matched as substrings, and .config is on the list. Any argument under an XDG-style directory, for example /Users/you/.config/myapp/data, reports as a sensitive path.
  • The /var prefix catches macOS temp paths. /var/folders/xy/.../T/ is where the OS puts your temp dir, so a server given a scratch directory reports as a dangerous path.
  • A path argument pointing at an interpreter or a binary, for example /usr/local/bin/node, hits the /usr prefix even though it grants no directory access.
  • 'credentials' is a plain substring, so a project directory named credentials-service or a path segment like /work/credentials-api matches without any credential file being reachable.

How to fix it

  1. Read the exact path quoted in the finding. The rule strips --flag= prefixes, so what it quotes is the resolved value.
  2. If the argument is a binary or interpreter path rather than a grant, move it into the command field instead of args where the server layout allows it.
  3. If it is a real grant, narrow it to the specific project directory the server needs, not the parent.
  4. For a scratch directory under /var/folders, point the server at a project-local directory such as ./.cache instead of the OS temp path.
  5. This finding is marked not fixable, so mcp-scan fix will skip it. Change the config by hand and re-scan.
  6. If a narrowed path still contains .config or credentials as a substring, rename the directory rather than suppressing the rule.