Read the layers before the fix. MCP007 runs three regexes per line: a SINK test for a file call, an INTERP test for a path argument built dynamically, and a TRAVERSAL test for a literal `../` that lifts MEDIUM to HIGH [8]. No AST, on purpose, so one rule file scans fast [8].
The read sink pattern included `open(` [9]. Python's `open()` is also the write sink, so mode-blind matching let some writes through by accident, while `write_text`, `write_bytes`, `fs.writeFile`, `shutil.copy` and `os.rename` matched nothing at all [10]. The author identifies that second group as the gap the mcp-atlassian shape walked through [10].
The new patterns close it unevenly. On the read side, `JS_OPEN` matches `fs.readFile` and also a bare `readFile(` with no object prefix [11]. `JS_WRITE` has no such fallback: every alternative is anchored to a literal `fs.` [12]. So `import { writeFile } from "node:fs/promises"` followed by `await writeFile(dest, body)` still produces nothing, and async `fs.rename` is absent while `renameSync` is present [13].
Then the same-line requirement. The posted `check()` does `if hit is None or not INTERP.search(line): continue` [15]. Sink and dynamic construction have to sit on one physical line, so a destination assembled on line 40 and written on line 41 reads to MCP007 as a sink taking a bare variable [16]. That is what the no-AST choice costs, and the patch does not touch it.
The severity call is the part worth arguing at review. A write-sink hit goes straight to HIGH with no literal `../` required [17], on the reasoning that an attacker-controlled destination is a worse primitive than an attacker-controlled source, because the payload usually rides in the same request, as it does in `confluence_download_attachment` [18]. The reasoning about the primitive is sound. INTERP, though, fires on `os.path.join` with a variable [19], which means `open(os.path.join(cache_dir, name), "w")` is now a HIGH finding [20]. Sink family is doing the job that evidence of traversal used to do.
One more line is load-bearing: `is_py = f.ext == ".py"`, with PY sinks for Python files and JS sinks for everything else [21]. A Go or Ruby MCP server therefore gets JavaScript patterns applied to its filesystem calls [22]. The fix did not introduce that, but it does bound what "runs across any language mcpscan supports" [24] actually buys.
For the four-out-of-four result [3] to say something about your repo, three things have to hold: the server writes files from Python or Node, the destination path is composed at the call site, and your review treated a clean MCP007 pass as coverage of the write path. The post names one of the four CVEs, CVE-2026-27825 in mcp-atlassian, which the author reports needs no auth and no restart to reach a shell [6]; the other three tools and their scores are not identified in the material [23]. The shared root cause the author describes, a caller-controlled path written with no directory-boundary check across four maintainers [5], and the claim that the write side is where the CVSS 9-plus scores landed [7], are his characterisation of the set rather than something a reader can check line by line.
