---
title: "Discussion on \"One Does Not Simply read_file('/etc/passwd') — Argument Policies Land in Heimdall MCP\" | Hashnode"
description: "Discussion on \"One Does Not Simply read_file('/etc/passwd') — Argument Policies Land in Heimdall MCP\". Heimdall MCP could already block tools by name. v1.4 closes the gap: argument-level constraints on calls that already passed the name check."
url: "https://hashnode.com/posts/one-does-not-simply-read-file-etc-passwd-argument-policies-land-in-heimdall-mcp/6a159eccda253d50d4b49838"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [One Does Not Simply read\_file('/etc/passwd') — Argument Policies Land in Heimdall MCP](https://blog.cardor.dev/one-does-not-simply-read-file-etc-passwd-argument-policies-land-in-heimdall-mcp?utm_source=hashnode&utm_medium=feed)

Heimdall MCP could already block tools by name. v1.4 closes the gap: argument-level constraints on calls that already passed the name check.

May 26 · 5 min read · blog.cardor.dev  
Read the article

-   [#agentic-ai](https://hashnode.com/tag/agentic-ai)
-   [#security](https://hashnode.com/tag/security)
-   [#llm](https://hashnode.com/tag/llm)
-   [#mcp](https://hashnode.com/tag/mcp)
-   [#vulnerability](https://hashnode.com/tag/vulnerability)

## Written by

[Enmanuel Magallanes](https://hashnode.com/@enmanuelmag)

@enmanuelmag · Manta, Ecuador

  
[View profile](https://hashnode.com/@enmanuelmag)

Senior Fullstack developer

I am a computer science engineer, I have also been a member of CERN’s Summer Students program in 2022. I am constantly learning and reviewing new web development technologies Frontend, Backend, DevOps

## Responses 2

Markdown supported · ⌘↵ to post

[Varsha](https://hashnode.com/@varsha23)

[May 27](https://hashnode.com/posts/one-does-not-simply-read-file-etc-passwd-argument-policies-land-in-heimdall-mcp/6a159eccda253d50d4b49838/comment/6a16e46ebadcd8afcbec7d07)

This is exactly the kind of MCP security issue people overlook. Tool access is powerful, but argument level controls matter just as much. It’s not enough to say “this tool is allowed.” The system also needs to know what inputs should never pass through.