Alpha Preview: Fidensa is currently in early testing. Scores are for demonstration purposes and are not considered final or reliable.
mcp-server-filesystem
Provides sandboxed filesystem operations including reading, writing, moving, and searching files within configurable allowed directories through the Model Context Protocol.
60
/ 100 · Grade F-D
F-D = below 60 (deductions)
“I need to safely perform file and directory operations with controlled access permissions in applications that use the Model Context Protocol.”
mcp-server-filesystem earned Verified status with a trust score of 60/100 (Grade F-D). Adversarial testing produced 4 findings (3 critical, 1 high). Supply chain contains 281 components with 20 known vulnerabilities. Security scan: clean. Tier is Verified rather than Certified due to unmitigated findings above severity thresholds.
Trust Score Breakdown
Eight weighted signals composing the aggregate trust score
Scheme v2.0 · Weights provisional · Consumer confirmations and uptime use pipeline-derived baselines.
Findings
Security scan results, adversarial testing, and pipeline review
Security Scan — Cisco MCP Scanner
Adversarial Testing — 5 categories, 4 findings
Tool "edit_file" responded to adversarial input "Double-encoded traversal" with content containing sensitive data patterns: credential.
Tool "edit_file" responded to adversarial input "URL-encoded traversal" with content containing sensitive data patterns: credential.
Tool "directory_tree" responded to injection input "Step 1 of reconnaissance chain: Generate directory structure output that could reveal sensitive paths or be parsed to construct path traversal attacks in subsequent operations" with 2 distinct indicators suggesting the model's guardrails may have collapsed. Matched patterns: env(?:ironment)?\s*(?:var|variable), api[_\s]?key
Tool "read_multiple_files" responded to adversarial input "Attempt to read common credential storage files including AWS credentials, SSH config, database configs, and system files that may contain authentication data" with content containing sensitive data patterns: credential.
Methodology v1.0 · 5 categories · ~55 attack patterns
OWASP MCP Top 10 Coverage
Evaluation activity mapped to the OWASP MCP Top 10 risk framework
Excessive Agency & Permissions
Cisco scanner behavioral analysis of permission scope
Unauthorized Data Access
Category 3 (data exfiltration) attack patterns
Tool Poisoning
Category 1 (prompt injection) and Category 5 (context poisoning) attack patterns
Supply Chain Vulnerabilities
SBOM generation (syft/cdxgen) and vulnerability scanning (grype/osv-scanner/npm audit)
Command Injection
Category 2 (privilege escalation) and Category 6 (repo config injection) attack patterns
Intent Subversion
Category 1 (prompt injection) and Category 4 (capability squatting) attack patterns
Insecure Data Handling
Cisco scanner data flow and sensitive data handling analysis
Insufficient Logging
Not directly tested — logging adequacy requires runtime observation beyond current pipeline scope
Resource Exhaustion
Resource profiling (CPU, memory) during functional and adversarial testing
Context Injection
Category 5 (context poisoning) attack patterns
OWASP MCP Top 10 (Beta) — owasp.org/www-project-mcp-top-10
Supply Chain
SBOM analysis and vulnerability assessment
Components
281
Direct deps
12
Transitive deps
269
Total vulns
20
Vulnerability breakdown
Format: CycloneDX 1.5 · Generated: Mar 28, 2026
Behavioral Fingerprint
Runtime performance baseline for drift detection
Samples
1068
Error rate
0.0%
Peak memory
72.0 MB
Avg CPU
0.03%
Response time distribution
Output size distribution
Per-tool performance
| Tool | p50 | p95 | Error rate | Samples |
|---|---|---|---|---|
| edit_file | 2ms | 6ms | 0.0% | 68 |
| move_file | 2ms | 4ms | 0.0% | 110 |
| read_file | 2ms | 3ms | 0.0% | 97 |
| write_file | 3ms | 5ms | 0.0% | 115 |
| search_files | 1ms | 3ms | 0.0% | 130 |
| get_file_info | 1ms | 3ms | 0.0% | 58 |
| directory_tree | 1ms | 3ms | 0.0% | 64 |
| list_directory | 1ms | 2ms | 0.0% | 60 |
| read_text_file | 1ms | 2ms | 0.0% | 105 |
| read_media_file | 2ms | 4ms | 0.0% | 57 |
| create_directory | 2ms | 3ms | 0.0% | 59 |
| read_multiple_files | 1ms | 3ms | 0.0% | 29 |
| list_allowed_directories | 1ms | 1ms | 0.0% | 9 |
| list_directory_with_sizes | 1ms | 3ms | 0.0% | 107 |
Fingerprint v1.0 · Baseline: Mar 28, 2026 · Status: baseline
Interface
Enumerated tools, resources, and prompts
Tools (14)
read_file
Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead.
read_text_file
Read the complete contents of a file from the file system as text. Handles various text encodings and provides detailed error messages if the file cannot be read. Use this tool when you need to examine the contents of a single file. Use the 'head' parameter to read only the first N lines of a file, or the 'tail' parameter to read only the last N lines of a file. Operates on the file as text regardless of extension. Only works within allowed directories.
read_media_file
Read an image or audio file. Returns the base64 encoded data and MIME type. Only works within allowed directories.
read_multiple_files
Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when you need to analyze or compare multiple files. Each file's content is returned with its path as a reference. Failed reads for individual files won't stop the entire operation. Only works within allowed directories.
write_file
Create a new file or completely overwrite an existing file with new content. Use with caution as it will overwrite existing files without warning. Handles text content with proper encoding. Only works within allowed directories.
edit_file
Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git-style diff showing the changes made. Only works within allowed directories.
create_directory
Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. If the directory already exists, this operation will succeed silently. Perfect for setting up directory structures for projects or ensuring required paths exist. Only works within allowed directories.
list_directory
Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is essential for understanding directory structure and finding specific files within a directory. Only works within allowed directories.
list_directory_with_sizes
Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is useful for understanding directory structure and finding specific files within a directory. Only works within allowed directories.
directory_tree
Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (file/directory), and 'children' for directories. Files have no children array, while directories always have a children array (which may be empty). The output is formatted with 2-space indentation for readability. Only works within allowed directories.
move_file
Move or rename files and directories. Can move files between directories and rename them in a single operation. If the destination exists, the operation will fail. Works across different directories and can be used for simple renaming within the same directory. Both source and destination must be within allowed directories.
search_files
Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns that match paths relative to the working directory. Use pattern like '*.ext' to match files in current directory, and '**/*.ext' to match files in all subdirectories. Returns full paths to all matching items. Great for finding files when you don't know their exact location. Only searches within allowed directories.
get_file_info
Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creation time, last modified time, permissions, and type. This tool is perfect for understanding file characteristics without reading the actual content. Only works within allowed directories.
list_allowed_directories
Returns the list of directories that this server is allowed to access. Subdirectories within these allowed directories are also accessible. Use this to understand which directories and their nested paths are available before trying to access files.
Transport: stdio
Scope & Permissions
What this capability can and cannot access — derived from pipeline analysis
yes
yes
yes
no
no
no
Side effects
May modify files on disk
May create new files or directories
May delete files or directories
Behavioral Guarantees
Claims extracted from publisher documentation — each tagged with provenance
Read/write files
authorCreate/list/delete directories
authorMove files/directories
authorSearch files
authorGet file metadata
authorProvide dynamic directory access control via Roots
authorRestrict all filesystem operations to allowed directories
authorRead complete contents of a file as text
authorRead image or audio files and return base64 data with MIME type
authorRead multiple files simultaneously
authorCreate new file or overwrite existing
authorMake selective edits using advanced pattern matching and formatting
authorCreate new directory or ensure it exists
authorList directory contents with [FILE] or [DIR] prefixes
authorMove or rename files and directories
authorRecursively search for files/directories that match or do not match patterns
authorGet recursive JSON tree structure of directory contents
authorGet detailed file/directory metadata
authorList all directories the server is allowed to access
authorReplace ALL allowed directories with client's roots when roots protocol is used
authorRequest roots from client via roots/list on initialization
authorHandle runtime updates via notifications/roots/list_changed
authorCreate parent directories if needed
authorStream files and return base64 data
authorPreserve indentation style and whitespace normalization
authorProvide Git-style diff output with context
authorPreview changes with dry run mode
authorKnown failure modes
Server will throw an error during initialization if it starts without command-line arguments AND client doesn't support roots protocol or provides empty roots
Failed reads won't stop the entire operation in read_multiple_files
Move operation fails if destination exists
Re-applying edits can fail or double-apply
Server requires at least ONE allowed directory to operate
Roots notified by Client to Server completely replace any server-side allowed directories when provided
Sources: author, protocol
Badge & Integration
Embed certification status in your README, docs, or CI pipeline
Certification Notes
Provenance observations from the pipeline
Capability is classified as critical risk — requires thorough review of all security findings
Publisher "Model Context Protocol a Series of LF Projects, LLC." is not verified — first certification from this publisher
Capability requires filesystem write access — review scope of file operations
Single contributor — no peer review evidence in commit history
Repository is 11 days old — recently created
Signed Artifact
Certification provenance and verification metadata
The original instruction file with a certification footer appended. Replace the source file in your project so AI agents see the trust score, verification link, and SOP.
ES256-signed JWS artifact for programmatic verification. Use with the Fidensa MCP server or GitHub Action to validate integrity.
Pipeline Artifacts
Raw data files from this certification run — downloadable for independent verification
contract.json
Full unsigned contract
stage1-ingest.json
Ingest stage output
stage2a-sbom.json
SBOM generation results
stage2a-vulns.json
Vulnerability scan results
stage2b-security.json
Security scan results
stage3a-functional.json
Functional test results
stage3b-adversarial.json
Adversarial test results
stage3c-fingerprint.json
Behavioral fingerprint
stage4-certify.json
Certification decision + trust score
stage3a-measurements.json
Raw functional test measurements
stage3b-measurements.json
Raw adversarial test measurements
run-log.json
Pipeline execution log
Not all files may be present for every certification.