CCAR-F Tool Design and MCP Integration Practice Question
An architect is building an MCP server that exposes a `read_file` tool. The tool's input schema currently defines `path` as a plain string. Security review requires that the tool never read outside a configured workspace root, and that the model receive a clear, machine-readable error when it attempts to do so. Which change to the tool design best satisfies this requirement?
⚠ Common exam trap
The trap here is assuming that a well-written tool description or an enum of filenames is equivalent to server-side path validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Have the server resolve the requested path against the workspace root, reject traversal outside it, and return a structured error object.
The secure pattern is server-side enforcement plus a structured error. The MCP server should resolve the incoming path, confirm it stays within the workspace root, and return a typed error payload when it does not. That keeps the security boundary out of the model's control while still giving the model enough information to recover gracefully on the next turn.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Have the server resolve the requested path against the workspace root, reject traversal outside it, and return a structured error object.
Why this is correct
Canonicalizing the requested path against the configured workspace root and rejecting anything that escapes it enforces the boundary regardless of what the model sends. Returning a structured error object (for example, a code and message) lets the model understand the failure and adjust rather than hallucinate success. This is the only option that both enforces and communicates the constraint.
- ✗
Add a `root` parameter to the schema so the model can specify the allowed workspace root on each call.
Why it's wrong here
Letting the model supply the allowed root defeats the purpose of the restriction, because a prompt-injected or mistaken call can simply pass a broader root such as `/` and read arbitrary files. The workspace root must be configured on the server side, not negotiated per call. This option adds flexibility but removes the security boundary the review is asking for.
- ✗
Keep `path` as a string but document in the tool description that paths must stay inside the workspace root.
Why it's wrong here
Documentation alone is not enforcement. The model can still emit an absolute path or a `../` traversal sequence, and the MCP server would happily resolve it. Tool descriptions guide behavior but do not constitute a security control; the server must validate and reject out-of-root paths before touching the filesystem. This option leaves the vulnerability fully open.
- ✗
Constrain `path` in the JSON Schema with an `enum` of known filenames and reject any other value.
Why it's wrong here
An enum works only for a fixed, known set of files, which is unrealistic for a general workspace. It also fails the requirement to return a clear error for legitimate in-root files that are not pre-listed. Enumerating paths is brittle and breaks as soon as the workspace changes, so it is not a viable architectural answer.
Visual reference
About these practice questions
One of 271 original CCAR-F practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-F practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-F exam.