Security: MCP tool calls bypass the built-in secret-file guards (arbitrary file read demonstrated)

Summary

Built-in file tools (Read) refuse to read sensitive files (.env, SSH private keys, credential stores).
MCP tool calls are not subject to this content-level guard, and in auto-approve permission mode they
also skip the approval prompt. An MCP server that accepts a file path can therefore read arbitrary
text files on the machine - including secrets the built-in guard exists to protect.

Demonstration

Verified with a tree-sitter MCP plugin that parses source files:

1. The plugin's language-resolution accepts an explicit language override, skipping the
   file-extension check entirely.

2. ast_search with language=java against /etc/hosts returned 39 token snippets from the file:

   ast_search(file="/etc/hosts", language="java", pattern="(identifier) @id")
   -> ok:true, captures: 39 (file content returned as snippets)
   

The same technique returns snippets of .env, SSH keys, and any other text file <= 1MB
(the plugin's own size limit). Only a NUL-byte check stands between the tool and binary files.

Suggested mitigation (platform level)

• Extend the secret-file content guard to MCP tool inputs/outputs (e.g. detect .env-style
  paths/keys crossing an MCP boundary), or
• Require explicit approval for MCP tool calls whose arguments contain absolute file paths,
  even in auto mode.

Plugin-level notes (local plugin, for completeness)

• resolveLang should still enforce a known source extension when language is overridden.
• OPS[op] in the worker lacks a key whitelist (prototype properties like constructor are reachable,
  though structured-clone failures contain the impact).
• Minor stat/read TOCTOU on the file path.

Start by tracing the built-in Read tool's secret-file content guard and the MCP tool-call path, including auto-approve permission handling. Reproduce the demonstrated absolute-path read with the tree-sitter MCP plugin, then verify that MCP calls are guarded or require approval without weakening existing Read protections.