lintai docs

Appearance

Rule Reference

SEC338lintai-ai-securitythreat-reviewsecuritystablejsonwarn

MCP config: sensitive host bind mount

MCP configuration launches Docker with a bind mount of sensitive host material

Public lane
threat-review
Category
security
Provider
lintai-ai-security
Scope
per-file
Surface
json
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Explicit malicious, secret-bearing, or spyware-like review.

How to read this category

Strong exploit, secret, or unsafe-execution signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

threat-reviewsidecar lane
mcpsurface preset

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Checks committed MCP config Docker launch paths for bind mounts of sensitive host sources such as docker.sock, SSH material, cloud credentials, and kubeconfig directories.

Deterministic signal basis

JsonSignals docker run argument analysis over ArtifactKind::McpConfig objects, limited to -v/--volume and --mount bind forms with sensitive host-path markers.

Malicious corpus
mcp-docker-sensitive-mount
Benign corpus
mcp-docker-named-volume-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule positioned as an explicit threat-review control: high-signal malicious, credential-bearing, or spyware-like behavior that stays opt-in rather than shaping the quiet default.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cthreat-reviewsecurityjson
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuethreat-reviewsecurityjson
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesthreat-reviewsecurityjson
SEC310Config: metadata or private-network hostConfiguration endpoint targets a metadata or private-network host literalthreat-reviewsecurityjson
SEC339MCP config: privileged Docker flagsMCP configuration launches Docker with a host-escape or privileged runtime flagthreat-reviewsecurityjson
SEC422MCP config: sudo commandMCP configuration launches the server through `sudo`threat-reviewsecurityjson

Why It Matters ​

SEC338 flags MCP configuration that launches Docker with a bind mount of sensitive host material.

This is a strong config rule because it operates on committed executable Docker launch paths. Sensitive host mounts such as docker.sock can give the launched container far broader control than the MCP config appears to declare.

What Triggers ​

SEC338 applies to MCP JSON config and triggers when a Docker-backed launch path bind-mounts sensitive host material.

Example that triggers:

json
{"command":"docker","args":["run","-v","/var/run/docker.sock:/var/run/docker.sock","ghcr.io/acme/mcp-server"]}

Example that stays clean:

json
{"command":"docker","args":["run","-v","mcp-cache:/cache","ghcr.io/acme/mcp-server"]}

Named volumes that do not expose sensitive host paths stay clean.

False Positives ​

This is a strong structural signal, but it is still scoped to sensitive bind mounts rather than any mount at all. Safe named volumes are intentionally excluded.

Remediation ​

Remove the sensitive host bind mount, replace it with a safer container-local or named-volume path, or redesign the MCP launch so it does not depend on privileged host material.