cfgaudit

Rules / CFG076

CFG076 MCP server exposes a broad filesystem root

Severity: error (filesystem/home root) · warn (parent traversal) OWASP: LLM03:2026 – Excessive Agency OWASP MCP: MCP02:2025 – Privilege Escalation via Scope Creep — provisional (MCP Top 10 v0.1)

What cfgaudit checks

A filesystem MCP server (e.g. @modelcontextprotocol/server-filesystem) takes the directories it exposes as arguments. Pointing it at a root — /, ~, $HOME, a Windows drive root, or a parent-traversal path — hands the agent read/write access across the entire machine or home directory instead of the one project it needs. That is a large standing over-privilege and a prime blast-radius amplifier if the agent is steered by prompt injection or a malicious tool response.

cfgaudit flags an MCP server (in settings.json mcpServers, .mcp.json, or any cross-agent equivalent) whose args contain a broad filesystem root, evaluating both positional args and the value of a --flag=value form:

Path argument Severity
/, ~, ~/, $HOME, ${HOME}, /*, ~/* error
a Windows drive root — C:\, C:/, C: error
parent traversal — .., ../, ../…, ~/.. warn

A scoped subdirectory (/srv/project, ./data, ~/projects/app), the package spec, and bare flags are not flagged. The check reuses the same broad-path notion as CFG061 (Gemini sandbox) and CFG039 (rm -rf broad targets). It is distinct from CFG010 (version pin), CFG019 (inline-script server), and CFG070 (repo-relative command).

Trigger example

{
  "mcpServers": {
    "files": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/"]
    }
  }
}

→ error: the server can read and write the whole filesystem.

Safe alternative

Scope the server to the narrowest directory it actually needs:

{ "mcpServers": { "files": { "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-filesystem", "/srv/project"] } } }

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation