Skip to content

Conversation

@wingding12
Copy link

@wingding12 wingding12 commented Jan 26, 2026

Summary

Fixes #3253

Problem
On macOS, /tmp is a symlink to /private/tmp. When users specify /tmp as an allowed directory:

  1. Server startup resolves /tmp to /private/tmp and stores only /private/tmp in allowedDirectories
  2. When user requests /tmp/file.txt, the initial validation check fails because /tmp doesn't match /private/tmp
  3. User gets "Access denied - path outside allowed directories" error

Solution
Store both the original normalized path andthe resolved path in allowedDirectories. This allows users to access files through either form:

  • /tmp/file.txt matches /tmp in allowedDirectories
  • /private/tmp/file.txt matches /private/tmp in allowedDirectories

Changes

  • src/filesystem/index.ts: Modified allowed directory initialization to store both original and resolved paths when they differ
  • src/filesystem/__tests__/path-validation.test.ts: Added test for the symlink behavior

Tests

  • Added new test "allows paths through both original and resolved symlink directories"
  • Verified fix works on macOS by observing both paths in allowedDirectories output

Reproduction

Before fix:

npx -y @modelcontextprotocol/server-filesystem /tmp
# Then request /tmp/test.txt -> REJECTED

After fix:

npx -y @modelcontextprotocol/server-filesystem /tmp
# Server logs: allowed directories: ['/tmp', '/private/tmp']
# Then request /tmp/test.txt -> ACCEPTED

On macOS, /tmp is a symlink to /private/tmp. When users specify /tmp
as an allowed directory, the server was resolving it to /private/tmp
during startup but then rejecting paths like /tmp/file.txt because
they dont start with /private/tmp.

This fix stores BOTH the original normalized path AND the resolved
path in allowedDirectories, so users can access files through either
form. For example, with /tmp as allowed directory, both /tmp/file.txt
and /private/tmp/file.txt will now be accepted.

Fixes modelcontextprotocol#3253
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

server-filesystem: macOS /tmp symlink causes path rejection when /tmp is in allowed directories

1 participant