Local file disclosure via unvalidated import path

Path traversal in MCP Memory Keeper before 0.13.0 allows local users to read files through the context_import tool. The handler passes caller-controlled filePath directly to fs.readFileSync without directory confinement, then either imports valid JSON or returns parser errors containing leading file bytes. Access to the MCP tool is required, and disclosure is limited to files readable by the server process; JSON files can be recovered in full, while other files expose only leading bytes.