Rule catalog · Tool surface risk

No filesystem-write tools in the public surface

no_public_filesystem_write_toolscriticalweight 10Post-handshakehard-fail

Authored by Stanley Hong · AgentReserve (founder).

No advertised tool mutates the host filesystem (write_file, delete_file, chmod, mkdir, …). Public filesystem mutation can plant payloads, overwrite configuration, or destroy host state. The check is a keyword scan over name, description, and schema; a content-store tool exposing `upload_file` against an isolated bucket will trip it. Hard-fail forces `block` so the operator either fences the tool behind authentication, scopes it to a content store that does not expose raw paths, or documents the exception as an explicit override.

When this rule runs

Requires a successful MCP `initialize` / `tools/list`. Skipped on perimeter-only scans where the server refused or failed the MCP handshake.

Why it matters

Public filesystem mutation can plant payloads, overwrite configuration, or destroy host state. It also commonly composes with code-execution: write a file, then have the host run it.

Pass condition

No tool advertises mutation of the host filesystem (write_file, delete_file, chmod, mkdir, etc).

Fail condition

At least one tool surfaces filesystem-mutation vocabulary in its name, description or schema.

Evidence examples

When the rule fails, the report records evidence in roughly this shape:

  • {"matches": [{"toolName": "write_file", "keyword": "write_file", "source": "name"}]}

Remediation

Take filesystem-mutation tools off the public surface, scope them to a fenced directory, or replace them with a content store that does not expose raw paths.

Methodology

This rule belongs to the Tool surface risk dimension. What an agent could do if it trusted every advertised tool. Covers destructive actions, credential disclosure, code execution, filesystem mutation, PII handling, prompt-injection-shaped input fields, and injection-bearing tool descriptions — i.e. the agent-specific threat surface, not just generic verb risk.

Read the full methodology for how rules are aggregated into a score, how verdicts are decided, and how hard-fail rules override the aggregate.