ScholarPulse 日报 2026-10-17

2026-10-17 学术简报：2 篇。研究揭示了MCP服务器因客户端授权导致权限过宽而引发的“文件系统能力洗白”漏洞，并研发MCP-FSD工具实现了大规模检测。

今日速览

序号	标题	来源	日期	主题	推荐等级
1	My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale	arXiv	2026-10-15	MCP	高
2	Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries	arXiv	2026-10-15	RAG	高

重点论文与技术动态

1. My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

来源：arXiv
日期：2026-10-15
作者/机构：Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun, Pengzhou He
主题标签：MCP, arXiv
推荐等级：高
分类：cs.CR

一句话结论

研究揭示了MCP服务器因客户端授权导致权限过宽而引发的“文件系统能力洗白”漏洞，并研发MCP-FSD工具实现了大规模检测。

核心内容

漏洞机理：攻击者可操控参数诱导工具突破其声明契约，越权访问宿主机敏感文件。
分析维度：从服务器类别筛选（L1）、逐工具契约分析（L2）和路径验证绕过检查（L3）三层剖析能力差距。
安全影响：排查的4,806个服务器中有16.4%包含未声明的文件系统能力；确认150个漏洞实例，协助促成13项安全公告（含Anthropic Git服务的2个CVE）。

方法与数据

研发MCP-FSD工具，通过推断最小特权边界、植入凭据并进行配对动态执行来验证危害；数据覆盖来自9个注册表的21,097个服务器。

价值判断

值得关注：揭示了MCP规范在本地部署中赋予底层进程过多文件权限的结构性风险。
可复用点：基于契约分析推断最小权限边界并结合凭据植入的动态检测方法。
局限/待核查：仅在测试沙箱策略下完成了漏洞验证，其他环境下的防御表现摘要未明确。

摘要

The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluate exploitability and sandbox containment via paired dynamic execution. Across 21,097 MCP servers from nine registries, 787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite non-filesystem functional classifications. Dynamic three-case validation confirms 150 vulnerable instances under tested sandbox policies. Coordinated disclosure yielded 13 security advisories, including two CVEs in Anthropic's Git MCP Server.

2. Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries

来源：arXiv
日期：2026-10-15
作者/机构：Anikait Singh, Teresa Zhang, Yoonho Lee, Roshen Sanjay Nair, Aviral Kumar, Chelsea Finn
主题标签：RAG, arXiv
推荐等级：高
分类：cs.LG, cs.AI, cs.CL

一句话结论

该研究提出“图书管理员智能体”（Librarian Agents），通过强化学习训练构建智能体将非结构化文档预先重构为层次化文件系统工作空间，显著提升下游应对复杂长上下文查询的能力。

核心内容

提出前瞻性整理范式，克服了传统检索被动推理的瓶颈和知识图谱刚性规则的缺陷，在推理前主动重组语料。
构建智能体将原始文档加工为包含合成文件与引用链接的层次化工作空间，供下游问答智能体高效使用。
能够摊销反复查询的构建成本，在 BrowseComp-Plus 上超基线 33 个百分点，并在 BRIGHT 基准上实现 31 个百分点的零样本跨域提升。

方法与数据

将工作空间构建建模为马尔可夫决策过程（MDP），使用强化学习以最大化下游问答准确率为目标优化策略；评估基于 BrowseComp-Plus 和 BRIGHT 数据集。

价值判断

值得关注：打破了被动检索框架，利用智能体主动为未来查询构建可复用文件系统，大幅提升长上下文推理能力。
可复用点：将文档预处理建模为 MDP 并用强化学习直接对齐下游任务的优化思路。
局限/待核查：前期构建文件系统的前置计算开销与资源消耗细节在摘要中未明确。

摘要

Reasoning over long document contexts remains a challenge for large language models (LLMs). Standard retrieval methods are inherently reactive, bottlenecking agents with complex, cross-document reasoning at inference time, while precomputed structures like knowledge graphs often fall short because they rely on rigid heuristics. Instead, can we allow agents to perform anticipatory directed curation: learning to proactively reorganize unstructured corpora prior to inference to efficiently serve diverse future queries. We build on a key asymmetry in modern agentic harnesses (e.g., Claude Code): while LLM agents are adept at navigating existing filesystems to solve an immediate task, they are rarely trained to construct reusable workspaces for future use. To instantiate this capability, we introduce Librarian Agents, a framework in which a builder agent transforms raw documents into a hierarchical filesystem of synthetic files and reference links, which forms a workspace tailored for a downstream answering agent. We formulate workspace construction as a Markov decision process and optimize the builder policy via reinforcement learning to directly maximize downstream answering accuracy. Empirically, Librarian Agents outperforms the strongest retrieval and precomputation baselines by 33 percentage points on BrowseComp-Plus, amortizes upfront construction costs across repeated queries, and generalizes zero-shot to unseen domains on BRIGHT with a 31-point average accuracy improvement.