diff --git a/src/Access.php b/src/Access.php
index 1b22204..e77a0c3 100644
--- a/src/Access.php
+++ b/src/Access.php
@@ -46,6 +46,9 @@ final class Access
         }
 
         $roles = apply_filters('lit_mcp_allowed_roles', $roles);
+        if (! is_array($roles)) {
+            $roles = self::DEFAULT_ROLES;
+        }
 
         return array_values(array_filter($roles, 'is_string'));
     }
diff --git a/tests/Unit/AccessTest.php b/tests/Unit/AccessTest.php
index c7868f1..e74b46f 100644
--- a/tests/Unit/AccessTest.php
+++ b/tests/Unit/AccessTest.php
@@ -31,6 +31,16 @@ final class AccessTest extends TestCase
         self::assertSame(['administrator', 'editor'], (new Access())->allowedRoles());
     }
 
+    public function testCorruptFilteredResultFallsBackToAdministrator(): void
+    {
+        Functions\when('get_option')->justReturn(['administrator']);
+        Filters\expectApplied('lit_mcp_allowed_roles')
+            ->once()
+            ->andReturn('editor');
+
+        self::assertSame(['administrator'], (new Access())->allowedRoles());
+    }
+
     public function testGrantsCapabilityToAllowedRole(): void
     {
         Functions\when('get_option')->justReturn(['editor']);