Bridge File System MCP Server
Local filesystem access for AI agents with root confinement and binary file detection.
Data last scanned today · Reviewed today
Overview
Bridge File System MCP Server provides a canonical reference implementation for exposing local directory structures to MCP-compatible AI clients. It includes ten integrated tools designed to facilitate file manipulation, directory listing, and metadata retrieval.
Our verdict
This server carries a high-risk rating of 30/100 due to a lack of independent editorial review and its status as a community-maintained project rather than an official vendor release. Users should exercise caution because critical security components like authentication methods remain unreviewed. It is suitable for local development environments where strict root confinement and file size limits are sufficient to mitigate operational risks.
- Strict path traversal prevention at the resolve level
- Configurable read-only mode to prevent accidental file modification
- Zero direct dependencies reduces the supply chain surface
- Explicit delete confirmation protects against accidental directory removal
- Authentication methods have not undergone security review
- Community-maintained status lacks official vendor vetting
- Bus-factor risk is elevated with a single contributor
Tools
| Tool | Description | Risk |
|---|---|---|
| read_file | Read file content. Returns is_binary=true, content=null for binary files. | low |
| write_file | Write text to a file. Optionally creates missing parent directories. | medium |
| list_directory | List directory contents with type, size, and timestamps. | low |
| search_files | Glob search within a directory, optionally recursive. | low |
| get_info | Metadata for a file or directory: type, size, timestamps, permissions. | low |
| create_directory | Create a directory, optionally including parents. | medium |
| copy_path | Copy a file or directory tree. | medium |
| move_path | Move a file or directory. Supports cross-filesystem moves. | medium |
| rename_path | Atomic rename within the same filesystem. | medium |
| delete_path | Delete a file or directory. Requires confirm=True. | high |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›How can I prevent the AI from accessing files outside a specific directory?
You can use the --root flag during configuration to restrict all filesystem operations to a specific directory tree. The server uses Path.resolve() to block path traversal and symlink escapes before any filesystem access occurs.
›Can I prevent the server from modifying my files?
Yes, enabling the --read-only flag disables all mutating operations, including write, move, copy, and delete, causing the server to raise an error if any of those tools are invoked.
›Is there a way to limit the size of files the AI reads?
You can set the --max-file-size-mb option to a specific number of megabytes to prevent the AI from reading large files accidentally.
›How do I safely delete a file using this server?
The delete_path tool requires you to explicitly provide confirm=True in every call to prevent accidental deletions. Note that the configured root directory itself can never be deleted.
›Does this server support transport methods other than Stdio?
Yes, you can use the --http flag along with a --port argument to run the server using HTTP/SSE transport instead of the default Stdio.
›What happens if the AI attempts to read a binary file?
The read_file tool detects binary content before decoding and returns a structured response indicating the file is binary, rather than throwing a UnicodeDecodeError.
Alternatives
Changelog
- Securityv0.1.1 - Audit fixes
2026-07-22
Badge
Maintain this server? Add the live badge to your README.