Back to course

Managing Tool Permissions & Security

Model Context Protocol (MCP) Server Engineering

Security Deep Dive

As we build more powerful tools, security becomes critical.

  1. Path Sanitization: Use path.resolve and check if the path starts with your root directory.
  2. Command Injection: Never use eval() or pass unsanitized strings to exec().

Assignment: Add a check to your File Writer tool to ensure it only writes to the ./allowed/ directory.