twitter-voice-mcp

## 2025-05-15 - Path Traversal in MCP Tools **Vulnerability:** MCP tools accepting file paths without validation allowing arbitrary file read. **Learning:** MCP servers expose local filesystem access directly to LLMs/users. Inputs must be strictly sandboxed. **Prevention:** Always validate file paths against a whitelist or safe directory using `os.path.commonpath` to ensure component-wise containment (avoiding `startswith` pitfalls).