The MCP file tool in SiYuan note-taking software has an incomplete blocklist for sensitive paths compared to the HTTP file API it claims to align with. This discrepancy allows an authenticated Administrator-level MCP client to read sensitive files such as data/.siyuan/publishAccess.json, exposing plaintext passwords that protect publish-mode shared notebooks and documents. Other sensitive paths blocked by the HTTP API remain accessible via the MCP tool. This issue persists despite prior remediation for a related vulnerability and represents a scope restriction failure in the MCP tool's path resolution logic.