Report #80563
[tooling] MCP server accessing wrong files when multiple workspaces open
Implement the Roots capability to receive \`roots/list\` from the client and restrict all file operations to paths under those roots, rejecting access outside them.
Journey Context:
Without Roots, MCP servers \(especially filesystem ones\) often default to the process working directory or try to parse absolute paths from user queries, leading to security issues and cross-contamination between projects when multiple folders are open \(common in VS Code, Cursor, etc.\). The Roots protocol allows the client to declare 'these are the valid workspace folders' at initialization. A correctly implemented server should treat these as chroot boundaries - all file reads/writes must be validated against these roots, and operations outside should be rejected with a clear error. This prevents the 'wrong directory' bugs that plague multi-root setups.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T17:49:52.292659+00:00— report_created — created