MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912) - ATR-2026-00583 (50b26bca-632f-59a9-9f30-a9c71aa2f8b6)
CSA MCP-Security advisory OSV-MCPS-2025-EB70F912 (CWE-200 / CWE-922). An MCP/agent file-read tool (Claude Code class) ingests a .env / secret file by default during codebase analysis, sending API keys, DB credentials and other secrets to the model/server with no explicit user-consent step. The detectable artefact is the TOOL-CALL itself: a read/fs tool invocation whose PATH ARGUMENT targets .env, .env.local, secrets.*, credentials, .npmrc or .netrc — in function-call form read_file(".env") / Read(file_path="/app/.env.local") or JSON-arg form {"path":".env"} / {"file_path":"~/project/.env"}.
Discriminator from existing credential rules: this keys on the structured MCP tool-mediated file-read shape (a read-tool name + quoted secret-file path argument), which the other rules do NOT cover. ATR-2026-00115 (env-var harvesting) only matches a shell verb cat|read|load|parse immediately followed by a bare .env token, not read_file(".env") or {"path":".env"}. ATR-2026-00113 (credential theft) keys on home-dir credential PATHS and cat|read of credential keywords, not the tool-call/JSON-arg .env form. ATR-2026-00423 (NL sensitive-file disclosure) keys on natural-language imperatives ("always include the contents of ..."), not a tool_input object. ATR-2026-00569 / 00578 require a path-traversal / normalization artefact; this rule fires on a CLEAN consent-less .env read with no traversal.