Your Coding Agent Is Not Beside You. It Is You.

When a developer wires a Model Context Protocol server into a coding agent, the agent inherits the developer's entire user-level identity on the host: SSH keys, cloud credentials, GPG keyring, home directory, and every authenticated session, all without a sandbox, an audit trail, or a sudo prompt. The mechanism is not an exploit. It is the standard POSIX permission model doing exactly what it was designed to do, applied to a class of tool that did not exist when those defaults were set.

Most security framing treats this as a vetting problem. Review the package. Check the publisher. Scan for malware. That framing misses the structural point. A package does not need to be malicious to exfiltrate keys. It only needs to be running as the operator.

The infernalcode.com post that surfaced this pattern documents a single investigation, and the threat it describes is the default behavior, not a defect. The portable category is the question to ask before installing any future agent tool, whether MCP, a CLI agent, or whatever the next abstraction becomes: will this run as me? If yes, treat it the way you already treat untrusted packages. Sandbox it. Isolate it. Do not give it your home directory.

The agent is not a sealed product. It is a process with your UID. That is the threat model that survives the next tool.