Submit #865116: HKUDS nanobot 0.2.1 Improper Access Control in MCP Capability Registration (CWE-284)

# Technical Details
An MCP capability allowlist bypass exists in the `connect_mcp_servers` method in `nanobot/agent/tools/mcp.py` of nanobot.

The application fails to apply `tools.mcp_servers.<name>.enabled_tools` consistently across MCP capability types. It filters normal entries returned by `session.list_tools()`, but still registers every resource from `session.list_resources()` and every prompt from `session.list_prompts()`. As a result, an operator can set `enabled_tools=[]` and still expose resource-backed data access or prompt-backed workflows.

# Vulnerable Code
File: nanobot/agent/tools/mcp.py
Method: connect_mcp_servers()
Why: The function enforces the allowlist only while iterating ordinary MCP tools. Resource and prompt wrappers are registered unconditionally afterward, causing a deny-all policy to fail open for those capability classes.

# Reproduction
1. Start a real stdio MCP server exposing one normal tool, one resource, and one prompt, then configure nanobot 0.2.1 with `enabled_tools=[]`.
2. Connect the server through nanobot’s real MCP registration path using the provided verification harness.
3. Observe that the normal tool is skipped, but `mcp_demo_resource_canary` and `mcp_demo_prompt_canary_prompt` remain registered and executable through `ToolRegistry.execute()`.

# Impact
- Operators cannot rely on `enabled_tools=[]` or a narrowed allowlist to suppress all MCP-derived capabilities from a server.
- Sensitive MCP resources or privileged prompt workflows may remain model-callable despite an explicit deny-all policy.

• Source: ⚠️ https://gist.github.com/YLChen-007/3de5f50d167a878f7530f57ed018d508
• User: Eric-c (UID 96848)
• Submission: 06/22/2026 04:21 (2 months ago)
• Moderation: 08/07/2026 14:07 (2 months later)
• Status: Accepted
• VulDB entry: 386998 [HKUDS nanobot up to 0.2.1 MCP enabledTools Scope mcp.py connect_mcp_servers access control]
• Points: 20