Respect Client Boundaries

You can fetch roots and read capabilities, but the real job is honoring them. A trustworthy server stays inside the lines the host drew for it. 🚧

Before touching any file, confirm its path sits within one of the client's roots. If it does not, refuse rather than reaching outside the allowed area.

A sneaky path like ../../etc can escape a root. Always resolve to an absolute, normalized path before comparing it against your allowed folders.

Test that the resolved path is relative to a root. The pathlib helper raises if it escapes, giving you a clean yes-or-no on whether to proceed.

If the client never declared a capability, do not call it. Respecting boundaries means trusting the negotiation, not poking at features that were never offered.

When roots are empty or unsupported, do not guess at the filesystem. Narrow what your tool does and tell the user why, instead of grabbing arbitrary paths.

Roots set an outer limit, but you can be stricter. Ask only for what a task truly needs, the spirit of least privilege, and leave the rest untouched.

Respect goes beyond paths. Honor the host's pace and limits too, so you never flood it with calls or ignore a cancellation the user asked for.

When a roots list_changed notice arrives, re-check any cached paths. A folder allowed a minute ago may now be outside the user's current scope.

If a request points outside the roots, return a clear error the model can read. A polite refusal beats silently doing something the user never sanctioned.

Servers that respect boundaries are the ones users keep installed. Good scoping turns a powerful tool into a safe one people are happy to grant access. 💛

One request targets a path outside every declared root. What should your server do?

You resolve paths, confirm they sit inside a root, skip undeclared features, degrade gracefully, and refuse out-of-scope work. That is what makes a server trustworthy. ✅