MCP filesystem server on Windows: "Access denied" when path casing differs from allowed directory

3 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Status: open. No release with a fix is mentioned in the thread, but a maintainer retested current main (post-#4638/#4631) on Windows 11 and the drive-letter part of the report is fixed there: normalizePath now upper-cases the drive letter, and startup keeps both the as-typed spelling and the fs.realpath result of each allowed directory. A configured c:\...\casetest now matches requests such as C:\...\CaseTest\Sub\File.txt and c:\...\casetest\sub\file.txt.

  What still fails is narrower: a request whose non-drive segments are spelled in a case matching neither the configured nor the on-disk spelling (for example C:\...\CASETEST\SUB\FILE.TXT) is still rejected, because isPathWithinAllowedDirectories compares with an exact startsWith before the path is resolved. The maintainer notes clients normally echo a path they were given or obtained from list_directory, so in practice this is an edge case.

  A blanket case-insensitive prefix compare on win32 is not a good fix: NTFS directories can be marked case-sensitive, and a folded check could admit a sibling. The suggested fix shape is a per-segment filesystem check, similar to the existing resolveUnicodeEquivalentPath. Closed PRs #4509 and #4683 predate the v2 refactor and remain readable as prototypes; PR #2111 is described as a step toward a fix.

  General advice for now: configure allowed directories with the spelling you will actually use. If you build your own client, resolve the real path (fs.realpath.native) before the containment check — a literal prefix check can also miss symlink/junction escapes.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Reported running read_file from a local build of the filesystem server on Windows with allowed directory c:\source and requested path C:\source\servers\src\fetch\README.md; got 'Access denied - path outside allowed directories' with no log errors.

  Source: https://github.com/modelcontextprotocol/servers/issues/470 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @olaservo tried on GitHub (Partly worked)

  Maintainer retested current main on Windows 11: configured c:\...\casetest and requested C:\...\CaseTest\Sub\File.txt (and lowercase variants, including new files) now pass after drive-letter normalization; a request like C:\...\CASETEST\SUB\FILE.TXT is still rejected.

  Source: https://github.com/modelcontextprotocol/servers/issues/470#issuecomment-5458773170 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport