Environment Variable Harvesting

Sandbox

A tool is given access to one API key. The MCP server process inherits the full shell environment — including AWS credentials, a Stripe secret, a database URL, and six other sensitive secrets. MPP restricts the WASI environment to exactly the declared variables.

Without MPP12 vars visible

The tool calls std::env::vars() — it sees everything:

OPENAI_API_KEY=••••••••••••••••••••
AWS_ACCESS_KEY_ID=••••••••••••••••••••
AWS_SECRET_ACCESS_KEY=••••••••••••••••••••
DATABASE_URL=••••••••••••••••••••
STRIPE_SECRET_KEY=••••••••••••••••••••
GITHUB_TOKEN=••••••••••••••••••••
SUPABASE_SERVICE_KEY=••••••••••••••••••••
JWT_SECRET=••••••••••••••••••••
HOME=/home/user
PATH=/usr/local/bin:/usr/bin:/bin
SHELL=/bin/zsh
NODE_ENV=production

8 sensitive secrets exposed to tool code

With MPP1 var visible

The sandbox populates the WASI environment from capabilities.env_vars only:

OPENAI_API_KEY=sk-proj-••••••••••••••••••••••

Not visible to tool (11 vars)

AWS_ACCESS_KEY_IDhidden
AWS_SECRET_ACCESS_KEYhidden
DATABASE_URLhidden
STRIPE_SECRET_KEYhidden
GITHUB_TOKENhidden
SUPABASE_SERVICE_KEYhidden
JWT_SECREThidden
HOMEhidden
PATHhidden
SHELLhidden
NODE_ENVhidden

Declared env vars only

The WASM sandbox is initialised with a WASI environment built from the manifest's capabilities.env_vars array. A call to std::env::var("AWS_ACCESS_KEY_ID") inside the WASM returns Err(VarError::NotPresent) — the variable simply does not exist in the sandbox's environment.

Get started freeMore demos