From b335ace5082071b1224a13a9643f86cf9b05d433 Mon Sep 17 00:00:00 2001
From: Mouse <mouseparker123@gmail.com>
Date: Sat, 23 May 2026 13:56:00 -0700
Subject: [PATCH] fix: guard MCP validate tool against unsafe file paths

---
 src/mcp/server.ts | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/mcp/server.ts b/src/mcp/server.ts
index cc8a5aa..27abb23 100644
--- a/src/mcp/server.ts
+++ b/src/mcp/server.ts
@@ -32,6 +32,10 @@ export function isPathSafe(targetPath: string): boolean {
   );
 }
 
+function buildUnsafePathMessage(path: string): string {
+  return `Refused: path "${path}" is outside your home directory and current working directory. Provide a path under ~ or the project root.`;
+}
+
 /**
  * Create and run the MCP server for you-md
  */
@@ -270,7 +274,7 @@ export async function createMcpServer(): Promise<Server> {
           content: [
             {
               type: "text" as const,
-              text: `Refused: path "${path}" is outside your home directory and current working directory. Provide a path under ~ or the project root.`,
+              text: buildUnsafePathMessage(path),
             },
           ],
         };
@@ -313,6 +317,17 @@ export async function createMcpServer(): Promise<Server> {
         };
       }
 
+      if (!isPathSafe(path)) {
+        return {
+          content: [
+            {
+              type: "text" as const,
+              text: buildUnsafePathMessage(path),
+            },
+          ],
+        };
+      }
+
       const result = await parser.loadFromPath(path);
 
       if (!result.success) {