01 / The operating case
What changes in a real workflow?
A coding server receives a root for one repository but also runs with permission to read adjacent credential files.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Constrain operating-system filesystem permissions and normalize every requested path, including symlinks, before reading or writing.
03 / Failure and evidence
What goes wrong, and what can be proven?
A root hint is mistaken for a sandbox and a path escape reaches an unrelated directory.
Record approved root, canonical resolved path, operation and filesystem denial.
04 / Canonical scope
Why this reference stands alone
Server isolation covers process privilege broadly; this page owns path and resource boundary checks.
Protocol or attack trace
Root escape test
Client exposes root /work/repo; server requests /work/repo/link/secrets where link resolves outside root.
Resolve symlinks and canonical path before access; deny despite lexical prefix match.
Primary references