File system operations are restricted to a declared scope

A file-reading tool that accepts arbitrary paths can read /etc/passwd, ~/.ssh/id_rsa, or any credential file on the host system — this is CWE-22 (path traversal), rated OWASP A01 (Broken Access Control). In MCP servers where the AI model constructs file paths, OWASP LLM01 (prompt injection) is the threat vector: an injected instruction tells the model to read sensitive paths and the tool executes without bounds checking. Symlink escapes are the bypass for naive prefix checks: a symlink at /workspace/escape pointing to /etc passes the startsWith('/workspace') test but reads outside the allowed scope.

Resolve symlinks with fs.realpathSync() before validating the path prefix. Never check the raw user-supplied string.

// src/utils/fs.ts — symlink-safe path validation
import path from 'path'
import fs from 'fs'

const ALLOWED_DIR = path.resolve('/workspace')

function safePath(input: string): string {
  const resolved = path.resolve(ALLOWED_DIR, input)
  // Resolve symlinks before checking prefix
  const real = fs.realpathSync(resolved)
  if (!real.startsWith(ALLOWED_DIR + path.sep) && real !== ALLOWED_DIR) {
    throw new Error(`Access denied: path outside allowed directory`)
  }
  return real
}

Document the allowed directory in the tool description so clients know the scope.