Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read files outside the intended .faf project context. The only remaining limit is OS file permissions.

refresh faf, faf score, faf get orchestration policy, refresh blend (and the shared getProjectPath() chokepoint feeding the .faf tools), plus the general-purpose faf read / faf write file tools (denylist-only; an absolute path still reached home-directory secrets, and faf write could write outside the project). refresh faf echoes the file contents verbatim back to the caller as "fresh DNA"; faf get orchestration policy reflects values parsed out of the attacker-chosen file and echoes the resolved absolute path — confirming the read.

An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).

Fixed in 1.5.3 by confining every caller-supplied path before any filesystem access (safe-path.ts):

Upgrade: npm install -g grok-faf-mcp@1.5.3 (or bunx grok-faf-mcp).

If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF ALLOWED ROOTS (patched versions) to a single project directory for a hard directory boundary.

Discovered and responsibly reported via coordinated disclosure by Zhihao Zhang (Worcester Polytechnic Institute).