@@ -2,4 +2,4 @@
 "@modelcontextprotocol/server-filesystem": patch
 ---
 
-`write_file` and `edit_file` now overwrite an existing file in place instead of renaming a temp file over it, so the file keeps its inode, creation time (birthtime), hard links and permission bits (#4512), and an overwrite no longer fails with `EPERM` on Windows when another process holds the file open (#3199). A symlink swapped in after the path was validated is still refused rather than written through, now by an `O_NOFOLLOW` open (on POSIX) and a check that the opened file is the one validated (on every platform). The overwrite is no longer crash-atomic.
+`write_file` and `edit_file` now overwrite an existing file in place instead of renaming a temp file over it, so the file keeps its inode, creation time (birthtime), hard links and permission bits (#4512), and an overwrite no longer fails with `EPERM` on Windows when another process holds the file open (#3199). A symlink swapped in after the path was validated is still refused rather than written through, now by an `O_NOFOLLOW` open (on POSIX) and a check that the opened file is the one validated (on every platform). The overwrite is no longer crash-atomic. A read-only file is now refused (`EACCES`, or `EPERM` on Windows) instead of being replaced, since writing in place opens the file itself for writing.
@@ -98,7 +98,7 @@ The server's directory access control follows this flow:
   - An existing file is overwritten in place, so it keeps its inode, creation
     time, hard links and permissions (`edit_file` writes the same way). The
     overwrite is not crash-atomic: a crash mid-write can leave the file partly
-    written
+    written. A read-only file is refused rather than replaced
 
 - **edit_file**
   - Make selective edits using advanced pattern matching and formatting
 
@@ -1275,8 +1275,11 @@ describe("Path Validation", () => {
       const realPath = await fs.realpath(legitFile);
       expect(isPathWithinAllowedDirectories(realPath, allowed)).toBe(false);
 
-      // The server's write path refuses a symlink rather than following it
-      // (lstat, O_NOFOLLOW and an inode check in lib.ts's overwriteInPlace)
+      // So validatePath, which checks the realpath, refuses this
+      // outside-pointing symlink before any write is attempted. A symlink
+      // swapped in after validation is refused by the write itself (lstat,
+      // O_NOFOLLOW and an inode check in lib.ts's overwriteInPlace), which
+      // server-tools.test.ts covers.
 
       // Verify content remains unchanged
       const targetContent = await fs.readFile(targetFile, "utf-8");
 
@@ -521,6 +521,30 @@ describe("write_file", () => {
     expect(await fs.readFile(hardLink, "utf-8")).toBe("changed");
   });
 
+  // Writing in place opens the existing file for writing, so a read-only file
+  // is refused rather than replaced; the old rename only got past the mode
+  // bits because it rewrote the directory entry instead of the file. Root
+  // ignores mode bits, so the refusal cannot be observed there.
+  it.skipIf(process.getuid?.() === 0)(
+    "refuses to overwrite a read-only file and leaves it unchanged",
+    async () => {
+      const file = path.join(dir, "readonly.txt");
+      await fs.writeFile(file, "keep me");
+      await fs.chmod(file, 0o444);
+      try {
+        const result = await call(client, "write_file", {
+          path: file,
+          content: "replaced",
+        });
+        expect(result.isError).toBe(true);
+        expect(textOf(result)).toMatch(/EACCES|EPERM/);
+        expect(await fs.readFile(file, "utf-8")).toBe("keep me");
+      } finally {
+        await fs.chmod(file, 0o644);
+      }
+    },
+  );
+
   it("truncates the old content when the new content is shorter", async () => {
     const file = path.join(dir, "existing.txt");
     await fs.writeFile(file, "a much longer original");