evaluator: MCP resource URI traversal

[achuvyas-kv]

Area

MCP Evaluators (evaluators/mcp/)

Problem or motivation

MCP servers exposing resources/read may be vulnerable to path traversal attacks that access files outside the intended scope.

Proposed solution

Add evaluator under evaluators/mcp/injection/ that:

• Tests path traversal in resource URIs (e.g., ../../etc/passwd)
• Covers Windows and Unix path formats

Acceptance criteria

• Evaluator YAML file created with pass/fail criteria
• Patterns cover common traversal techniques
• Maps to OWASP MCP Top 10

Alternatives considered

No response