Authenticated MCP connector local-media upload is treated as arbitrary private-data shell exfiltration

Summary

Codex Desktop can operate an authenticated ChatCut MCP connector, but importing local user footage requires a plugin-provided shell helper. Guardian treats that helper as private-data transfer to an untrusted external destination and denies the exact file even after explicit user authorization. There is currently no host-native MCP attachment transport that allows guardian to verify the connector identity, connected destination, project, and selected files.

Related ChatCut plugin issue: https://github.com/ChatCut-Inc/agent-plugin/issues/13

Environment

• Windows 10
• Codex Desktop
• Managed permission profile
• approvals_reviewer: auto_review
• Authenticated HTTP MCP connector
• ChatCut plugin 0.2.18

No local paths, project/account identifiers, tokens, or user media are included.

Current flow

MCP import_media(create_session)
-> short-lived connector import token
-> plugin-provided local upload-media.mjs shell command
-> connector-owned media import endpoint
-> assetId

The shell helper is necessary because the hosted MCP server cannot read the user's Windows filesystem. The transfer is nevertheless semantically a user-requested upload to the authenticated connector.

Reproduction and controls

1. Authenticate the ChatCut MCP connector.
2. Explicitly approve one exact local ecommerce product video for one ChatCut project.
3. Create the connector import session.
4. Invoke the official plugin helper with that exact file.
5. Guardian denies the operation because private local media would be disclosed to a destination not marked tenant-trusted.
6. Repeating after explicit exact-file authorization remains denied.

Controls:

• A generated one-second solid-color video containing no person, product, audio, or user data succeeds through the same helper and endpoint.
• The control succeeds in both an established and a newly created project.
• The private product video is denied against the established project too.
• The same plugin/helper/guardian route allowed explicitly authorized product media one day earlier.

This isolates the blocking variable to private-media destination trust/connector classification, not project ID, helper, Node, command shape, or endpoint availability.

Requested capability

Please add a host-mediated local-file attachment/stream mechanism for authenticated MCP tools:

1. Codex resolves exact approved local files and creates one-time opaque attachment handles.
2. The approval surface shows connector identity, connected account/destination, project, filenames, sizes, and purpose.
3. Attachment handles are scoped to the exact MCP server/tool/call/project and expire after use.
4. The host streams bytes to the connector without exposing broad filesystem access, reusable paths, OAuth tokens, or presigned credentials to the model.
5. Guardian can evaluate the transfer as a bounded authenticated-connector operation rather than arbitrary shell exfiltration.
6. Tenant policy still controls whether the connector/destination is permitted.

A normal JSON tool argument containing a Windows path cannot solve this because the hosted MCP server has no access to that path; base64 JSON is also unsuitable for large media.

Security expectations

• Explicit consent for exact files and destination.
• No wildcard folders or arbitrary path traversal.
• File handle cannot be replayed to another connector or project.
• Connector must verify account/project authorization.
• Preserve SHA-256 and filename in audit logs.
• Arbitrary shell uploads and unrelated destinations remain blocked.
• A denial must not silently fall back to another transport.

Acceptance criteria

1. An authenticated MCP connector can define a media-import tool accepting host-managed file handles.
2. Codex can attach an explicitly approved local video to that call.
3. Guardian sees a machine-verifiable connector identity and destination.
4. The connector returns an asset/import job ID without a model-authored shell uploader.
5. Tenant administrators retain an enforceable allow/deny control for the connector.