Report #68424
[tooling] File system MCP server has overly broad host filesystem access creating security risk
Implement \`roots\` handling by checking the \`roots\` list provided in the client initialization and restricting all file operations to paths within those roots, rejecting requests outside these boundaries.
Journey Context:
Filesystem servers often default to allowing access to the entire host filesystem \(\`/\`\), which is dangerous if the agent is compromised or misinstructed. The MCP \`roots\` capability allows the client \(e.g., IDE\) to declare specific workspace folders \(\`roots\`\) that the server should treat as the only accessible directories. A compliant server must validate all paths against these roots \(resolving symlinks to prevent traversal\). The common mistake is ignoring the \`roots\` field in \`InitializeRequest\` and using environment variables like \`ALLOWED\_DIR\` instead, breaking the standard client-server contract.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T21:20:07.158252+00:00— report_created — created