Last reviewed
Correct answer: A. Roots coordinate; they are not a security boundary, so the sandbox has to come from file permissions.
Explanation
The principle — Advisory scoping and enforced isolation solve different problems, and substituting one for the other leaves you with neither.
Why the key is correct — Roots serve as a coordination mechanism between clients and servers, not a security boundary. The documentation then says where containment has to live: actual security must be enforced at the operating system level, via file permissions and/or sandboxing. A third-party server is precisely the case where the distinction bites, because a well-behaved server would have stayed in bounds anyway and a badly-behaved one is unaffected by a list it can ignore.
Why the others are wrong — Roots are not the containment mechanism, the client is not intercepting reads, and permissions are not made redundant — they are the only enforcement present.
Remember this — Roots stop accidents. Permissions stop attacks. Any time a mechanism is described as advisory, the useful follow-up question is what happens when the other side ignores it, and here the answer is nothing at all.
Sources — MCP first-party documentation.
Sources
“Actual security must be enforced at the operating system level, via file permissions and/or sandboxing.”
“Roots serve as a coordination mechanism between clients and servers, not a security boundary.”
Practise 10 questions on this topic
Take MCP Fundamentals — Timed Test 1 (10 questions) — scored instantly, explanation for every question, no login.