How to build a symlink-safe path traversal guard for MCP file tools

MCP servers that expose file tools like read_file or write_file are vulnerable to path traversal attacks, where crafted inputs can expose sensitive system files such as /etc/passwd. Common defenses like prefix checks and os.path.normpath fail because they do not resolve symlinks or handle absolute paths correctly. A more robust solution uses Python's Path.resolve() on both the base directory and the user-supplied path, followed by a strict containment check to ensure the resolved target stays within the sandbox. Developers are advised to refuse and error out on suspicious paths rather than attempting to sanitize them, as sanitization approaches tend to reintroduce vulnerabilities over time. Regression tests covering known attacker payloads, including symlink escapes and encoded traversal strings, are recommended to ensure the guard remains effective as codebases evolve.