test_safe_join_rejects_symlink_escape fails on Windows without elevation or Developer Mode

Apri tests/shared/test_path_security.py e analizza test_safe_join_rejects_symlink_escape intorno alla riga 145. Esegui uv run pytest tests/shared/test_path_security.py su una macchina Windows senza privilegi per i symlink, quindi verifica che il test venga saltato solo quando la creazione del symlink viene rifiutata e che la suite non presenti errori quando i symlink sono disponibili.

Initial Checks

• I confirm that I'm using the newest release of my line (the latest 2.x, or the latest 1.x if I'm still on v1)
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Release line

2.x (current stable)

Description

Running the test suite on Windows as a normal, non-elevated user fails in
tests/shared/test_path_security.py:

tests\shared\test_path_security.py:145: in test_safe_join_rejects_symlink_escape
    (sandbox / "escape").symlink_to(outside)
E   OSError: [WinError 1314] A required privilege is not held by the client

The test creates a symlink unconditionally. Windows only permits symlink creation for an
elevated process, or for a normal user with Developer Mode enabled — neither is the
default state of a Windows machine.

Why CI doesn't catch it: the Windows job in .github/workflows/shared.yml is green, and
this test only passes when symlink_to() succeeds, so those runners evidently do have the
privilege. The failure appears only on an ordinary developer machine, so the suite is
permanently green in CI and permanently red locally.

Why it matters: it denies a Windows contributor a clean baseline. A first uv run pytest
returns a failure unrelated to their change, and the natural assumption — that their own
setup is broken — costs time. Everything else passes: 5791 passed, 1 failed, 16 skipped.
It also weakens the suite's signal, since someone who learns to expect one red test may
not notice a second.

Suggested fix — skip when the platform refuses, leaving every assertion intact so the
test still exercises safe_join wherever symlinks work, including all current CI:

try:
    (sandbox / "escape").symlink_to(outside)
except OSError as exc:
    pytest.skip(f"symlink creation is not permitted here: {exc}")

This is the only test in the suite that creates a symlink. I have this prepared and
verified locally (suite goes to 0 failures; the test skips for the right reason rather
than passing vacuously). Happy to open a PR — following CONTRIBUTING, I'll wait for the
issue to be assigned first.

Example Code

git clone https://github.com/modelcontextprotocol/python-sdk
cd python-sdk
uv sync
uv run pytest tests/shared/test_path_security.py

Python & MCP Python SDK

Python 3.14.7 | Windows-11-10.0.26200-SP0
mcp 2.0.1.dev23+56af447
mcp-types 2.0.1.dev23+56af447
pytest 8.4.2