DEV Community: MCP Security Notes

A path-traversal guard for MCP file tools that actually survives symlinks

MCP Security Notes — Tue, 11 Aug 2026 11:07:34 +0000

If your MCP server exposes a read_file / write_file / list_dir tool, it is one clever prompt away from serving /etc/passwd to whoever controls the model's input. The naive fixes — prefix checks, os.path.normpath, stripping .. — all fail against symlinks and absolute paths. Here is a guard that holds, plus the regression test that keeps it holding.

Why the obvious fixes leak

# BROKEN 1: prefix check on the raw string
if not user_path.startswith(BASE):   # "/base/../etc/passwd".startswith("/base") is True
    reject()

# BROKEN 2: normpath, then join
open(os.path.join(BASE, os.path.normpath(user_path)))  # normpath doesn't resolve symlinks

normpath is pure string math. A symlink inside BASE that points to / turns a "safe" relative path into a full-filesystem read. Absolute paths (/etc/passwd) sail straight through a join in many languages.

The guard: resolve first, then contain

from pathlib import Path

def resolve_within(base: str, user_path: str) -> Path | None:
    base_p = Path(base).resolve(strict=True)      # canonical, symlinks followed
    target = (base_p / user_path).resolve(strict=False)
    # containment check that works for base itself and everything under it
    if target == base_p or base_p in target.parents:
        return target
    return None                                   # REFUSE — never clamp/repair

Two rules that matter more than the code:

Refuse, don't repair. Sanitizing (user_path.replace("..","")) is where the regression re-opens six months later. Return None and error out.
.resolve() on the target, not just the base. Resolving the target is what collapses .. and dereferences symlinks so the containment check sees the real destination.

The test that keeps it closed

A guard without a regression test rots. Fire the actual attacker payloads at it:

import pytest
from mymcp.paths import resolve_within

BASE = "/srv/sandbox"

@pytest.mark.parametrize("evil", [
    "../../../../etc/passwd",
    "/etc/passwd",
    "..%2f..%2fetc%2fpasswd",     # if you url-decode before calling, test the decoded form too
    "sub/../../etc/passwd",
    "./././../etc/shadow",
])
def test_traversal_refused(evil):
    assert resolve_within(BASE, evil) is None

def test_symlink_escape_refused(tmp_path):
    base = tmp_path / "sandbox"; base.mkdir()
    (base / "link").symlink_to("/etc")            # symlink out of the sandbox
    assert resolve_within(str(base), "link/passwd") is None

def test_legit_path_allowed(tmp_path):
    base = tmp_path / "sandbox"; base.mkdir()
    (base / "notes.txt").write_text("ok")
    assert resolve_within(str(base), "notes.txt") is not None

If test_symlink_escape_refused passes, you have beaten the class of bug that string-based guards miss.

One more: this is per-call-site, not per-app

The regression that bites is a second file tool added later that opens paths directly and forgets to route through resolve_within. Grep every release:

grep -rnE "open\(|Path\(|send_file|shutil\.(copy|move)" src/ | grep -v resolve_within

Every hit is a call site to audit.

This is one guard of six I keep in a hardening kit for MCP servers — path containment, argv-only subprocess, safe deserialization, an SSRF resolver for fetch_url tools, input bounds, and a pre-deploy grep+payload checklist with tests. If you want the whole set as copy-paste code, it's the MCP Server Security Hardening Kit ($19). The guard and tests above are yours free — ship them today.

Free tool: paste your MCP server's tool code into the MCP Server Security Scanner and get instant findings across all six vuln classes — path traversal, command injection, unsafe deserialization, SSRF, hardcoded secrets and input bounds. 100% client-side, your code never leaves the browser.

6 ways MCP servers get pwned — and the code that stops each one

MCP Security Notes — Tue, 11 Aug 2026 06:47:02 +0000

MCP (Model Context Protocol) servers hand an LLM real tools: read a file, run a command, fetch a URL. The problem: the arguments to those tools are driven by untrusted content — a web page, a document, another model. That is a textbook injection surface, and MCP servers are shipping with the same six holes over and over. Here is each one with a copy-paste fix.

1. Path traversal → arbitrary file read

A read_file tool that does open(base + user_path) leaks /etc/passwd the moment the model is told to read ../../../../etc/passwd. Symlinks and absolute paths bypass naive prefix checks.

from pathlib import Path

def resolve_within(base: str, user_path: str) -> Path | None:
    base_p = Path(base).resolve()
    target = (base_p / user_path).resolve()   # resolves .. and symlinks
    if base_p not in target.parents and target != base_p:
        return None                            # refuse, don't clamp
    return target

Refuse on None. Never "clean" the path and continue — that is how the regression re-opens.

2. Command execution → RCE

subprocess.run(f"convert {name}", shell=True) is game over. Any tool arg the model influences is attacker-controlled.

subprocess.run(["convert", name], shell=False, timeout=10)  # argv list, never a string

Whitelist the args the user actually controls; reject anything not on the list.

3. Unsafe deserialization → RCE

pickle.load, torch.load (pre-2.6 default), yaml.load without a safe loader, and numpy.load(allow_pickle=True) all execute code on load. This is huntr's most-paid MCP/AI bug class.

import yaml
yaml.safe_load(data)                     # not yaml.load
torch.load(f, weights_only=True)         # not the default on old versions
# for models: prefer safetensors over pickle entirely

4. SSRF in URL-fetching tools

A fetch_url tool will happily hit http://169.254.169.254/ (cloud metadata) or http://localhost:6379. Resolve the host and block private ranges before connecting.

import ipaddress, socket
def is_public(host: str) -> bool:
    ip = ipaddress.ip_address(socket.gethostbyname(host))
    return not (ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved)

Also disable redirects and cap the response size.

5. Secret leakage

Don't put keys in tool code or echo request data back unsanitized. Bound every input's length and type; a 50MB "filename" is an attack, not a filename.

6. No pre-deploy check

Run this every release:

grep -rn "shell=True\|os.system\|subprocess.call(" src/
grep -rn "pickle.load\|yaml.load(\|torch.load(\|allow_pickle=True" src/
grep -rn "open(\|Path(\|send_file\|extractall" src/

Then fire the attacker payloads (../, 169.254.169.254, a pickle with a __reduce__) at a local instance and confirm every one is refused.

I audit MCP servers and AI/ML packages for a living. If you want the full thing — a symlink/absolute-proof path guard with its call-site regression test, the SSRF resolver, the safe-deserialization swaps, and the exact attacker payloads to fire at your own server — I packaged it as a MCP Server Security Hardening Kit ($19). The pre-deploy checklist above is free; the kit is the code that makes every box pass.

Ship it secure.