Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-31 · high
A Windows-style path fooled the reference server into treating it as relative, so the write reported success while the file went elsewhere.
Why now: The fix is new enough that plenty of reference-server installs still carry the bug it patches.
PR #4704 closes a bug that sent file writes to the wrong place on POSIX hosts, in the Model Context Protocol's reference filesystem server. The write still reported success, so an agent had no signal to check whether the file ended up where it was supposed to go.
The bug triggered on Windows-style paths. Feed the server something like C:\Users\me\notes\file.md on a POSIX host, and it didn't recognize the drive letter as an absolute path. Instead it resolved the whole string as a relative filename inside the allowed directory.
Thirteen lines close it: reject drive-letter path forms before relative resolution kicks in, on POSIX only, plus a regression test. It doesn't touch how the server behaves on Windows. It also doesn't change resolution for paths that aren't trying to look like a Windows path.
How long the bug was live, or how many setups it hit, isn't in the PR. Anyone running the reference filesystem server with agents that write across platforms should update.
Each link below shares sources, entities, or timing with this story.
Shared entity: Anyone / Same source domain / Shared topic / Earlier coverage
Both cover Anyone; reported by the same outlet (github.com); overlapping topics (anyone, appeared, server).
Both cover Anyone; reported by the same outlet (github.com); overlapping topics (anyone, been).
Both cover Anyone; reported by the same outlet (github.com); overlapping topics (anyone, filesystem).
Shared entity: Users / Same source domain / Shared topic / Earlier coverage
Both cover Users; reported by the same outlet (github.com); overlapping topics (agent, server).
Shared entity: Anyone / Same source domain / Earlier coverage / Tension
Both cover Anyone; reported by the same outlet (github.com); earlier Anyone coverage from 2026-08-30.
Both cover Anyone; reported by the same outlet (github.com); earlier Anyone coverage from 2026-08-25.
Both cover Anyone; reported by the same outlet (github.com); earlier Anyone coverage from 2026-07-28.
Shared entity: Anyone / Shared topic / Earlier coverage / Tension
Both cover Anyone; overlapping topics (agent, anyone); earlier Anyone coverage from 2026-06-27.