MCP Filesystem symlink containment diverged under case folding

The file server attempted to reconcile Unicode-equivalent names before checking a path boundary. The test uses an existing symlink with capitalization different from the resolved spelling; the path validator misses it, but the filesystem honors it. This is a distinct identity mismatch from the trailing-quote flaw. primary evidence provides a reproducible creation outside the allowed tree in its selected environment.

The reporter did not show a broad live exploit campaign, and mount-specific behavior should not be extrapolated to every APFS or NTFS configuration.

The security check must be performed against the same canonical, filesystem-resolved object used by the write. Test case-insensitive mounts and all destination-bearing tools, not just file reads.

The filesystem determines name equality. On a case-insensitive mount, an allowed symlink path can be spelled with different capitalization than the path examined by the server's symlink guard. The OS follows the existing link while the check misses it; write_file, create_directory and move_file destinations therefore warrant separate tests. This is not the parent-directory race or the trailing-quote normalization flaw, although all three let validation differ from the eventual filesystem object. Version 2.0.1 addresses the case-variant advisory; platform behavior outside the reported reproduction remains untested.