Comment by lowcache

Author of the post, and dev of mcp-box here. Wrote this after realizing every MCP server on my machine had the same access to ~/.ssh that I do, and nothing in the installation messages posting to stdout mentions it. I think prompt injection is the vector and the permissions model is the red carpet giving a warm welcome. Interested in where that's wrong.