提交 #865118: HKUDS nanobot 0.2.1 Improper Access Control in MCP Wrapper Exposure (CWE-284)

# Technical Details
An MCP scope bypass exists in the `connect_mcp_servers` method in `nanobot/agent/tools/mcp.py` of nanobot.

The application fails to enforce `tools.mcpServers.<name>.enabledTools` for resource and prompt wrappers during live gateway operation. Even with `enabledTools: []`, nanobot 0.2.1 still registers and exposes resource and prompt wrappers in the Settings API and in the actual tool list sent to the LLM provider during a WebSocket turn.

# Vulnerable Code
File: nanobot/agent/tools/mcp.py
Method: connect_mcp_servers()
Why: The registration code filters only `session.list_tools()` results. It then registers wrappers from `session.list_resources()` and `session.list_prompts()` without the same policy check, so leaked wrappers remain visible and callable end-to-end.

# Reproduction
1. Start a real `nanobot gateway` with a local MCP server exposing one ordinary tool, one resource, and one prompt, and configure `enabledTools: []`.
2. Use the provided deterministic provider and verification scripts to inspect `/api/settings/mcp-presets/test` or trigger a live WebSocket chat turn.
3. Observe that the ordinary MCP tool is absent, but `mcp_demo_resource_canary_resource` and `mcp_demo_prompt_canary_prompt` still appear in the registered/model-facing tool list.

# Impact
- A supposedly deny-all or narrowed MCP policy still leaks model-callable wrappers derived from resources and prompts.
- Sensitive internal reads, templates, or privileged prompt workflows may remain exposed through the gateway despite explicit operator restrictions.

• 来源: ⚠️ https://gist.github.com/YLChen-007/64ee28f96041fc6baaec89a85b63c3b2
• 用户: Eric-c (UID 96848)
• 提交: 2026-06-22 04時22分 (2 月前)
• 管理: 2026-08-07 14時07分 (2 months later)
• 状态: 重复
• VulDB条目: 386998 [HKUDS nanobot 直到 0.2.1 MCP enabledTools Scope mcp.py connect_mcp_servers 权限提升]
• 积分: 0