Invia #865118: HKUDS nanobot 0.2.1 Improper Access Control in MCP Wrapper Exposure (CWE-284)

# Technical Details
An MCP scope bypass exists in the `connect_mcp_servers` method in `nanobot/agent/tools/mcp.py` of nanobot.

The application fails to enforce `tools.mcpServers.<name>.enabledTools` for resource and prompt wrappers during live gateway operation. Even with `enabledTools: []`, nanobot 0.2.1 still registers and exposes resource and prompt wrappers in the Settings API and in the actual tool list sent to the LLM provider during a WebSocket turn.

# Vulnerable Code
File: nanobot/agent/tools/mcp.py
Method: connect_mcp_servers()
Why: The registration code filters only `session.list_tools()` results. It then registers wrappers from `session.list_resources()` and `session.list_prompts()` without the same policy check, so leaked wrappers remain visible and callable end-to-end.

# Reproduction
1. Start a real `nanobot gateway` with a local MCP server exposing one ordinary tool, one resource, and one prompt, and configure `enabledTools: []`.
2. Use the provided deterministic provider and verification scripts to inspect `/api/settings/mcp-presets/test` or trigger a live WebSocket chat turn.
3. Observe that the ordinary MCP tool is absent, but `mcp_demo_resource_canary_resource` and `mcp_demo_prompt_canary_prompt` still appear in the registered/model-facing tool list.

# Impact
- A supposedly deny-all or narrowed MCP policy still leaks model-callable wrappers derived from resources and prompts.
- Sensitive internal reads, templates, or privileged prompt workflows may remain exposed through the gateway despite explicit operator restrictions.

• Fonte: ⚠️ https://gist.github.com/YLChen-007/64ee28f96041fc6baaec89a85b63c3b2
• Utente: Eric-c (UID 96848)
• Sottomissione: 22/06/2026 04:22 (2 mesi fa)
• Moderazione: 07/08/2026 14:07 (2 months later)
• Stato: Duplicato
• Voce VulDB: 386998 [HKUDS nanobot fino a 0.2.1 MCP enabledTools Scope mcp.py connect_mcp_servers escalationi di privilegi]
• Punti: 0