diff --git a/src/mcp/server.ts b/src/mcp/server.ts
index cc8a5aa..27abb23 100644
--- a/src/mcp/server.ts
+++ b/src/mcp/server.ts
@@ -32,6 +32,10 @@ export function isPathSafe(targetPath: string): boolean {
   );
 }
 
+function buildUnsafePathMessage(path: string): string {
+  return `Refused: path "${path}" is outside your home directory and current working directory. Provide a path under ~ or the project root.`;
+}
+
 /**
  * Create and run the MCP server for you-md
  */
@@ -270,7 +274,7 @@ export async function createMcpServer(): Promise<Server> {
           content: [
             {
               type: "text" as const,
-              text: `Refused: path "${path}" is outside your home directory and current working directory. Provide a path under ~ or the project root.`,
+              text: buildUnsafePathMessage(path),
             },
           ],
         };
@@ -313,6 +317,17 @@ export async function createMcpServer(): Promise<Server> {
         };
       }
 
+      if (!isPathSafe(path)) {
+        return {
+          content: [
+            {
+              type: "text" as const,
+              text: buildUnsafePathMessage(path),
+            },
+          ],
+        };
+      }
+
       const result = await parser.loadFromPath(path);
 
       if (!result.success) {