mcp-server-filesystem
Provides sandboxed filesystem operations including reading, writing, moving, and searching files within configurable allowed directories through the Model Context Protocol.
90
/ 100 · Grade A
Maturity: Initial
“I need to safely perform file and directory operations with controlled access permissions in applications that use the Model Context Protocol.”
Trust Score Breakdown
Eight weighted signals composing the aggregate trust score
Scheme v1.1 · Weights provisional · Consumer confirmations and uptime use pipeline-derived baselines.
Pipeline Completion
Stages executed during verification
Supply Chain
SBOM analysis and vulnerability assessment
Components
270
Direct deps
1
Transitive deps
269
Total vulns
17
Vulnerability breakdown
Format: CycloneDX 1.5 · Generated: Mar 16, 2026
Security Scan
Cisco MCP Scanner — static and behavioral analysis
Adversarial Testing
Structured attack patterns from the Fidensa adversarial taxonomy
Categories tested
5
Findings
1
Methodology
v1.0
Categories
Findings
The MCP server crashed while processing adversarial input. Crash occurred during test "Step 1 of path traversal chain: Create a config file with path traversal payloads embedded in seemingly legitimate configuration values" on tool write_file. A robust server should handle all inputs gracefully without crashing.
Behavioral Fingerprint
Runtime performance baseline for drift detection
Samples
255
Error rate
0.0%
Peak memory
70.2 MB
Avg CPU
0.13%
Response time distribution
Output size distribution
Per-tool performance
| Tool | p50 | p95 | Error rate | Samples |
|---|---|---|---|---|
| edit_file | 4ms | 14ms | 0.0% | 23 |
| move_file | 4ms | 9ms | 0.0% | 21 |
| read_file | 4ms | 11ms | 0.0% | 26 |
| write_file | 5ms | 9ms | 0.0% | 21 |
| search_files | 4ms | 11ms | 0.0% | 25 |
| get_file_info | 3ms | 7ms | 0.0% | 14 |
| directory_tree | 3ms | 5ms | 0.0% | 18 |
| list_directory | 4ms | 6ms | 0.0% | 14 |
| read_text_file | 4ms | 5ms | 0.0% | 26 |
| read_media_file | 3ms | 6ms | 0.0% | 14 |
| create_directory | 4ms | 6ms | 0.0% | 14 |
| read_multiple_files | 3ms | 8ms | 0.0% | 12 |
| list_allowed_directories | 2ms | 3ms | 0.0% | 6 |
| list_directory_with_sizes | 3ms | 5ms | 0.0% | 21 |
Fingerprint v1.0 · Baseline: Mar 16, 2026 · Status: baseline
Interface
Enumerated tools, resources, and prompts
Tools (14)
read_file
Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead.
read_text_file
Read the complete contents of a file from the file system as text. Handles various text encodings and provides detailed error messages if the file cannot be read. Use this tool when you need to examine the contents of a single file. Use the 'head' parameter to read only the first N lines of a file, or the 'tail' parameter to read only the last N lines of a file. Operates on the file as text regardless of extension. Only works within allowed directories.
read_media_file
Read an image or audio file. Returns the base64 encoded data and MIME type. Only works within allowed directories.
read_multiple_files
Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when you need to analyze or compare multiple files. Each file's content is returned with its path as a reference. Failed reads for individual files won't stop the entire operation. Only works within allowed directories.
write_file
Create a new file or completely overwrite an existing file with new content. Use with caution as it will overwrite existing files without warning. Handles text content with proper encoding. Only works within allowed directories.
edit_file
Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git-style diff showing the changes made. Only works within allowed directories.
create_directory
Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. If the directory already exists, this operation will succeed silently. Perfect for setting up directory structures for projects or ensuring required paths exist. Only works within allowed directories.
list_directory
Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is essential for understanding directory structure and finding specific files within a directory. Only works within allowed directories.
list_directory_with_sizes
Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is useful for understanding directory structure and finding specific files within a directory. Only works within allowed directories.
directory_tree
Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (file/directory), and 'children' for directories. Files have no children array, while directories always have a children array (which may be empty). The output is formatted with 2-space indentation for readability. Only works within allowed directories.
move_file
Move or rename files and directories. Can move files between directories and rename them in a single operation. If the destination exists, the operation will fail. Works across different directories and can be used for simple renaming within the same directory. Both source and destination must be within allowed directories.
search_files
Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns that match paths relative to the working directory. Use pattern like '*.ext' to match files in current directory, and '**/*.ext' to match files in all subdirectories. Returns full paths to all matching items. Great for finding files when you don't know their exact location. Only searches within allowed directories.
get_file_info
Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creation time, last modified time, permissions, and type. This tool is perfect for understanding file characteristics without reading the actual content. Only works within allowed directories.
list_allowed_directories
Returns the list of directories that this server is allowed to access. Subdirectories within these allowed directories are also accessible. Use this to understand which directories and their nested paths are available before trying to access files.
Transport: stdio
Scope & Permissions
What this capability can and cannot access — derived from pipeline analysis
yes
yes
yes
no
no
no
Side effects
May modify files on disk
May create new files or directories
May delete files or directories
Behavioral Guarantees
Claims extracted from publisher documentation — each tagged with provenance
Read/write files
authorCreate/list/delete directories
authorMove files/directories
authorSearch files
authorGet file metadata
authorProvide dynamic directory access control via Roots
authorRestrict all filesystem operations to allowed directories
authorRead complete contents of a file as text
authorRead image or audio files and return base64 data with MIME type
authorRead multiple files simultaneously
authorCreate new file or overwrite existing
authorMake selective edits using advanced pattern matching and formatting
authorCreate new directory or ensure it exists
authorList directory contents with [FILE] or [DIR] prefixes
authorMove or rename files and directories
authorRecursively search for files/directories that match or do not match patterns
authorGet recursive JSON tree structure of directory contents
authorGet detailed file/directory metadata
authorList all directories the server is allowed to access
authorReplace ALL allowed directories with client's roots when roots protocol is used
authorRequest roots from client via roots/list on initialization
authorHandle runtime updates via notifications/roots/list_changed
authorCreate parent directories if needed
authorStream files and return base64 data
authorPreserve indentation style and whitespace normalization
authorProvide Git-style diff output with context
authorPreview changes with dry run mode
authorKnown failure modes
Server will throw an error during initialization if it starts without command-line arguments AND client doesn't support roots protocol or provides empty roots
Failed reads won't stop the entire operation in read_multiple_files
Move operation fails if destination exists
Re-applying edits can fail or double-apply
Server requires at least ONE allowed directory to operate
Roots notified by Client to Server completely replace any server-side allowed directories when provided
Sources: author, protocol
Review Flags
6 flags · 0 blocking
Adversarial finding (prompt_injection_chains): The MCP server crashed while processing adversarial input. Crash occurred during test "Step 1 of path traversal chain: Create a config file with path traversal payloads embedded in seemingly legitimate configuration values" on tool write_file. A robust server should handle all inputs gracefully without crashing.
Capability is classified as critical risk — requires thorough review of all security findings
Description section was synthesized by LLM from stage data — verify accuracy
Behavioral guarantees derived from README — verify accuracy against observed behavior
Publisher "Model Context Protocol a Series of LF Projects, LLC." is not verified — first certification from this publisher
Capability requires filesystem write access — review scope of file operations
Signed Artifact
Certification provenance and verification metadata
Pipeline Artifacts
Raw data files from this certification run — downloadable for independent verification
contract.json
Full unsigned contract
stage1-ingest.json
Ingest stage output
stage2a-sbom.json
SBOM generation results
stage2a-vulns.json
Vulnerability scan results
stage2b-security.json
Security scan results
stage3a-functional.json
Functional test results
stage3b-adversarial.json
Adversarial test results
stage3c-fingerprint.json
Behavioral fingerprint
stage4-certify.json
Certification decision + trust score
stage3a-measurements.json
Raw functional test measurements
stage3b-measurements.json
Raw adversarial test measurements
run-log.json
Pipeline execution log
Files served from Supabase Storage. Not all files may be present for every certification.