Lesson Content

The file system access risk.

An MCP server with file system access can read and write files on the host system. Without path restrictions, a server that accepts a path parameter from Claude's tool call can be used (via prompt injection) to read or write any file the server process can access – including credentials, configuration files, and sensitive data.

Path restriction implementation.

Every file system tool must validate that the requested path is within the allowed root:

import os
from pathlib import Path

ALLOWED_ROOT = Path("/allowed/directory").resolve()

def validate_path(requested_path: str) -> Path:
resolved = (ALLOWED_ROOT / requested_path).resolve()
if not str(resolved).startswith(str(ALLOWED_ROOT)):
raise ValueError(f"Path {requested_path} is outside allowed root")
return resolved

@app.call_tool()
async def call_tool(name: str, arguments: dict):
if name == "read_file":
path = validate_path(arguments["path"]) # validates before any file access
return [types.TextContent(type="text", text=path.read_text())]

The .resolve() call on both paths normalizes ../ traversal sequences before the comparison – preventing path traversal attacks.

Path traversal attacks.

Path traversal: a tool argument of ../../etc/passwd – without path validation, this resolves to /etc/passwd, outside the intended directory. The .resolve() approach prevents this by resolving the final path and checking it starts with the allowed root.

Principle of least privilege for file system access.

Configure the server's allowed root to be the minimum necessary:

• A documentation server: read access to the docs directory only
• A code analysis server: read access to the project directory only
• A file editor: read/write access to a specific working directory only

Do not give a documentation server write access. Do not give a read-only server access to the entire file system. Each server's permissions should match exactly what its tools need.

Process-level permissions.

Beyond path validation in code, run the MCP server process as a user with limited file system permissions. A server that needs read access to /docs/ should run as a user that only has read access to /docs/. This provides defense in depth – even if the path validation has a bug, the OS-level permissions limit what the server can actually access.