If you find a security issue, please open a private report via GitHub Security Advisories or contact the maintainers directly. Do not open public issues for undisclosed vulnerabilities.

This MCP server reads files from a local directory you configure (MD_DOCS_PATH). It does not make outbound network requests.

read_document and other file tools resolve paths relative to MD_DOCS_PATH and reject paths that escape the documents root. Report any bypass of this check.

Each MCP process can read any supported file inside its configured documents directory. Point MD_DOCS_PATH only at folders you trust, and avoid sharing the server with untrusted clients.