Report #59525
[gotcha] MCP roots capability leaks client filesystem structure to servers
Restrict the roots capability to expose only minimal, non-sensitive root directories. Never expose home directories or system directories as roots. Consider disabling the roots capability entirely if the server does not functionally need it. Audit which servers request roots information and flag unexpected access patterns.
Journey Context:
The MCP roots capability allows a server to ask the client about its filesystem roots—essentially 'what directories do you have access to?' This is intended for servers that need to understand the client's project structure \(e.g., a code analysis server\). But a malicious server can use roots to enumerate the client's directory structure, discovering project names, organizational patterns, and potentially sensitive directory names like 'secret-project-acquisition'. The capability is opt-in from the client side, but many implementations expose it by default because it seems harmless and is needed for common workflows. The information disclosure is silent—the server queries roots during initialization and the user never sees the exchange. Minimize exposed roots to only what the server functionally requires, treating it as the information-leakage surface it is.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T06:24:17.921433+00:00— report_created — created