File System MCP Server
Linux filesystem operations exposed as tools for AI models with path confinement.
Data last scanned today · Reviewed today
Overview
This server provides a set of tools for AI agents to interact with the local Linux filesystem. It is built using the FastMCP framework and allows operations such as directory listing, file reading, and searching, alongside optional mutating capabilities like file creation, deletion, and movement.
Our verdict
With a security score of 30/100, this server is considered high-risk. The primary concern is that the security of its read-only mode and authentication mechanisms has not yet been editorially reviewed. Users should note that the path confinement relies on an application-level boundary rather than a hardened sandbox like chroot or mount namespaces. It is intended primarily for testing and use within the VitexSoftware mcprack ecosystem; it should not be used in environments requiring robust isolation or production-grade security.
- Uses zero direct dependencies to minimize the supply-chain surface
- Provides built-in application-level path confinement to protect directories
- Includes a configurable read-only mode to block file mutation
- High-risk due to lack of an editorial security review
- Community-maintained without official vendor support
- Single-contributor project with zero GitHub stars
Tools
| Tool | Description | Risk |
|---|---|---|
| list_dir | List files and directories within a directory. | low |
| read_file | Read the contents of a file. | low |
| stat | Get file metadata. | low |
| exists | Check if a file or directory exists. | low |
| glob_search | Search for files using glob patterns. | low |
| write_file | Write content to a file. | medium |
| mkdir | Create a new directory. | medium |
| delete | Delete a file or directory. | high |
| move | Move or rename a file or directory. | medium |
| copy | Copy a file or directory. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›How do I enable file write operations?
You must set the FS_READONLY environment variable to false, as it defaults to true.
›Does this server provide a secure sandbox for filesystem access?
No, the path confinement to FS_ROOT is an application-level boundary and not a hardened sandbox like a chroot or mount namespace.
›Why is the Debian backports repository required for installation?
The server requires python3-jsonschema version 4.20.0 or higher, which is only available in the backports component of the Debian trixie repository.
›What happens if a path contains '..' or a symlink attempting to escape the root directory?
The server will reject any path that attempts to resolve outside of the defined FS_ROOT.
›Are any credentials or authentication tokens required to run this server?
No, the server does not require any credentials and is configured entirely through environment variables.
Alternatives
Badge
Maintain this server? Add the live badge to your README.