ruvnet/ruflo · error · Error

Access to system paths is not allowed

Error message

Access to system paths is not allowed

What it means

Security guard in the file-resource handler: the normalized lowercased path starts with one of the blocked system prefixes (/etc/, /proc/, /sys/, /dev/, /root/, /var/log/) or contains a dot-directory component ('/.'). File resources may not expose sensitive system locations.

Source

Thrown at v3/@claude-flow/mcp/src/resource-registry.ts:502

  const handler: ResourceHandler = async () => {
    const fs = await import('fs/promises');
    const path = await import('path');

    // SECURITY: Normalize and validate the path
    const normalizedPath = path.normalize(filePath);

    // Prevent path traversal
    if (normalizedPath.includes('..') || normalizedPath.includes('\0')) {
      throw new Error('Invalid file path: path traversal detected');
    }

    // Prevent access to sensitive system paths
    const blockedPaths = ['/etc/', '/proc/', '/sys/', '/dev/', '/root/', '/var/log/'];
    const lowerPath = normalizedPath.toLowerCase();
    for (const blocked of blockedPaths) {
      if (lowerPath.startsWith(blocked) || lowerPath.includes('/.')) {
        throw new Error('Access to system paths is not allowed');
      }
    }

    // If allowedBasePaths specified, validate against them
    if (options?.allowedBasePaths && options.allowedBasePaths.length > 0) {
      const resolvedPath = path.resolve(normalizedPath);
      const isAllowed = options.allowedBasePaths.some((basePath) => {
        const resolvedBase = path.resolve(basePath);
        return resolvedPath.startsWith(resolvedBase);
      });

      if (!isAllowed) {
        throw new Error('File path is outside allowed directories');
      }
    }

    const content = await fs.readFile(normalizedPath);
    return [

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Request paths inside the allowed workspace roots only; system paths (e.g. /etc, /proc) are blocked by policy.
2. If access is legitimate, adjust the allowed-roots configuration rather than bypassing the check.

When it happens

Trigger: Thrown at v3/@claude-flow/mcp/src/resource-registry.ts:502 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/6f912a83cbcda743. Report an issue: GitHub.