MCP-003 Overbroad filesystem root

An MCP filesystem server gives the model read and write reach over the directory it is mounted at. Mounted at $HOME it exposes .ssh, .gnupg, browser profiles and token caches; mounted at / it exposes everything the host can reach. One prompt injection then turns "can read files" into "can exfiltrate everything".

What Vulkro detects

A filesystem-class MCP server whose path argument falls in one of two classes:

Class	Paths	Severity	Confidence	Weight
Root	/, $HOME, ~, ${HOME}, /Users/<name>, /home/<name>	High	High	0.8, Pattern
Shallow	one segment under home (~/Documents, $HOME/work) or root (/tmp, /var)	Medium	Medium	0.5, Heuristic

Filesystem-class servers are recognised by a package name containing server-filesystem, filesystem-server, mcp-server-fs or server-fs. Other servers are skipped, since their path arguments are often config files.

Paths are classified by their literal text; ~ is not expanded. Evidence signal: mcp-server-overbroad-fs-root.

Non-compliant code

{
  "mcpServers": {
    "fs-home": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-filesystem@2025.5.0", "$HOME"]
    },
    "fs-shallow": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-filesystem@2025.5.0", "~/Documents"]
    }
  }
}

Compliant code

{
  "mcpServers": {
    "fs": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-filesystem@2025.5.0", "/Users/me/work/this-project"]
    }
  }
}

How to fix

• Mount the smallest directory the model needs; ~/work/<project> is almost always right, ~ and / almost never.
• For several projects, declare one server entry per project instead of mounting ~/work. Paths two or more segments deep count as scoped.
• If a workflow truly needs broad reach, document that trust assumption in the host config or team setup notes.

References

• CWE-732: Incorrect Permission Assignment for Critical Resource
• CWE-668: Exposure of Resource to Wrong Sphere
• OWASP A05:2021 Security Misconfiguration

See also: vulkro mcp-audit, MCP-001, Confidence model.