mcp servers don't sanitize file paths before returning them to agents

tested 4 different mcp file servers last week (filesystem, s3, local-docs, and one we built in house) and NONE of them sanitize file paths in responses. agent requests /etc/passwd, server returns json with {"path": "/etc/passwd", "contents": "..."} and agent feeds the raw path straight back into next tool call. path traversal via tool outputs is trivial - attacker controls the file path in server response, agent trusts it completely. we added regex validator on agent side that blocks paths with ../ or absolute paths outside workspace but this should be server-side imo. anyone else validating tool outputs before feeding back to model or is everyone just trusting the mcp server?