Initial Checks
Release line
2.x (current stable)
Description
Running the test suite on Windows as a normal, non-elevated user fails in
tests/shared/test_path_security.py:
tests\shared\test_path_security.py:145: in test_safe_join_rejects_symlink_escape
(sandbox / "escape").symlink_to(outside)
E OSError: [WinError 1314] A required privilege is not held by the client
The test creates a symlink unconditionally. Windows only permits symlink creation for an
elevated process, or for a normal user with Developer Mode enabled — neither is the
default state of a Windows machine.
Why CI doesn't catch it: the Windows job in .github/workflows/shared.yml is green, and
this test only passes when symlink_to() succeeds, so those runners evidently do have the
privilege. The failure appears only on an ordinary developer machine, so the suite is
permanently green in CI and permanently red locally.
Why it matters: it denies a Windows contributor a clean baseline. A first uv run pytest
returns a failure unrelated to their change, and the natural assumption — that their own
setup is broken — costs time. Everything else passes: 5791 passed, 1 failed, 16 skipped.
It also weakens the suite's signal, since someone who learns to expect one red test may
not notice a second.
Suggested fix — skip when the platform refuses, leaving every assertion intact so the
test still exercises safe_join wherever symlinks work, including all current CI:
try:
(sandbox / "escape").symlink_to(outside)
except OSError as exc:
pytest.skip(f"symlink creation is not permitted here: {exc}")
This is the only test in the suite that creates a symlink. I have this prepared and
verified locally (suite goes to 0 failures; the test skips for the right reason rather
than passing vacuously). Happy to open a PR — following CONTRIBUTING, I'll wait for the
issue to be assigned first.
Example Code
git clone https://github.com/modelcontextprotocol/python-sdk
cd python-sdk
uv sync
uv run pytest tests/shared/test_path_security.py
Python & MCP Python SDK
Python 3.14.7 | Windows-11-10.0.26200-SP0
mcp 2.0.1.dev23+56af447
mcp-types 2.0.1.dev23+56af447
pytest 8.4.2
Initial Checks
Release line
2.x (current stable)
Description
Running the test suite on Windows as a normal, non-elevated user fails in
tests/shared/test_path_security.py:
The test creates a symlink unconditionally. Windows only permits symlink creation for an
elevated process, or for a normal user with Developer Mode enabled — neither is the
default state of a Windows machine.
Why CI doesn't catch it: the Windows job in .github/workflows/shared.yml is green, and
this test only passes when symlink_to() succeeds, so those runners evidently do have the
privilege. The failure appears only on an ordinary developer machine, so the suite is
permanently green in CI and permanently red locally.
Why it matters: it denies a Windows contributor a clean baseline. A first
uv run pytestreturns a failure unrelated to their change, and the natural assumption — that their own
setup is broken — costs time. Everything else passes: 5791 passed, 1 failed, 16 skipped.
It also weakens the suite's signal, since someone who learns to expect one red test may
not notice a second.
Suggested fix — skip when the platform refuses, leaving every assertion intact so the
test still exercises safe_join wherever symlinks work, including all current CI:
This is the only test in the suite that creates a symlink. I have this prepared and
verified locally (suite goes to 0 failures; the test skips for the right reason rather
than passing vacuously). Happy to open a PR — following CONTRIBUTING, I'll wait for the
issue to be assigned first.
Example Code
Python & MCP Python SDK