MCP Roots Define Filesystem Scope

Servers must normalize and resolve paths before access, checking final absolute paths against root prefixes. Roots can change during a session and may be empty. Symlinks inside roots can point outside, requiring explicit validation. No OS-level isolation is enforced; real security relies on system permissions and path checks.

Summarised from the original article by an open-source model, then checked automatically: every number and English name must appear in the source. The original article is authoritative.