Per OWASP ASVS V12: protect file handling + resources. Requirements include (a) validate file uploads including type + size + content + scanning + (b) sandbox file processing + storage + serving + (c) protect against path traversal + null byte injection + similar file attacks + (d) implement secure file download + appropriate Content-Disposition + content type + (e) protect against ZIP slip + similar archive attacks + (f) implement resource limits against denial of service + (g) maintain inventory + classification of files + resources.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.