MCP filesystem server has access to an entire drive or home folder

HighAV-MCP-101MCPMCP config pack

What it finds

The filesystem MCP server is given a whole drive or your entire home folder instead of one project folder.

Why it matters

Everything in that folder becomes readable (and often writable) by the AI — SSH keys, browser data, .env files, documents. One injected instruction is enough to read or change them.

What an attacker could do: The AI could read or modify any file in your home folder or drive, including credentials.

How to fix it

Point the filesystem server at the specific project folder it needs (for example ~/projects/my-app), never / or your home directory.

Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans

Check details

Finding code: MCP_FILESYSTEM_BROAD_ROOT
How it detects: Looks for a specific risky pattern in the code or config.
Confidence: Definite: the risky setting is written plainly in the file.
Scans: MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
OWASP LLM Top 10: LLM08 - Excessive Agency, LLM06 - Sensitive Information Disclosure
NIST AI RMF: GV-4.1, MS-2.3
SOC 2: CC6.1, CC6.3

Check your agent for this

Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.

Scan an agent free Run it in CI or your editor