Skip to content

fix(filesystem): only apply MCP roots when no CLI directories are provided#4014

Closed
Will-hxw wants to merge 4 commits intomodelcontextprotocol:mainfrom
Will-hxw:fix/3929-roots-override
Closed

fix(filesystem): only apply MCP roots when no CLI directories are provided#4014
Will-hxw wants to merge 4 commits intomodelcontextprotocol:mainfrom
Will-hxw:fix/3929-roots-override

Conversation

@Will-hxw
Copy link
Copy Markdown

Summary

  • Only call updateAllowedDirectoriesFromRoots when allowedDirectories.length === 0, so CLI arguments take precedence over MCP roots

Why

Issue #3929: When clientCapabilities.roots is true, the server unconditionally replaces CLI-specified directories with client roots, preventing the server from being limited to directories outside the client project root.

Validation

  • Code review passed
  • Branch pushed to fork

Will-hxw and others added 4 commits April 21, 2026 04:35
The resourceType argument in the resource-prompt was missing a
description of allowed values. Added "must be 'Text' or 'Blob'" to
help automated callers understand the expected input format.

Issue: #3985

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Prevent leaking all process.env variables by requiring a specific key.
This addresses a security concern where the tool was returning the
entire environment without any parameter or filtering.

Issue: #3986

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
When a client supports MCP roots, the server was unconditionally
replacing CLI-provided allowed directories with the client's roots.
This made it impossible to scope the server to a directory outside
the client's project root.

Now CLI arguments take precedence - only fetch and apply MCP roots
when no CLI directories were provided.

Fixes: #3929

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The roots/list_changed handler was unconditionally replacing allowedDirectories with MCP roots, even when CLI directories were set. Adding the same guard as oninitialized to prevent MCP roots from overriding CLI directories when both are present.
@Will-hxw
Copy link
Copy Markdown
Author

CI Failure Analysis

The Test everything check is failing due to TypeScript strict mode type errors in src/everything/tools/get-env.ts.

Error Details

  1. Line 33: Parameter 'args' implicitly has an 'any' type
  2. Line 33: Argument of type '{ title: string; description: string; inputSchema: {...} }' is not assignable to parameter of type...

Root Cause

The new code uses args (via const { key } = args as { key: string }) but args lacks a proper type annotation. With tsconfig.json having strict: true, TypeScript requires explicit typing.

Suggested Fix

Add proper type annotation to the args parameter. Example fix pattern:

interface GetEnvArgs {
  key: string;
}

server.registerTool(name, config, async (args: GetEnvArgs): Promise<CallToolResult> => {
  const { key } = args;
  // ...
});

@Will-hxw Will-hxw closed this by deleting the head repository Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant