MCP Risk

Scan report

@modelcontextprotocol/server-filesystem

This page reports an automated security scan of @modelcontextprotocol/server-filesystem (npm), scanned 2026-07-26. It rates trust (provenance, transport, known vulnerabilities, instruction integrity) as grade B and capability risk (what the tools can do) separately at high. It does not certify the server is safe to connect; it reports what could be checked from outside.

npm, scanned 2026-07-26, tool surface via package-source

B 81/100 Capability risk: High permalink

The grade rates trust: provenance, transport, known vulnerabilities and instruction integrity. Capability risk rates what the tools can do and is reported, not penalised – a server built to run shell commands is doing its job (Policy §2.4).

Automated checks

StatusCheckPolicyResult
WARN Listed on the official MCP registry §1.1

Not found on the official MCP registry. Not disqualifying, but listed servers carry namespace-verified provenance.
PASS Source repository is public and maintained §1.2
Active repository with a license. 5 findings
  • Repository ↗
  • Last push: 0 days ago
  • Stars: 88895
  • License: NOASSERTION
  • Security policy (SECURITY.md): absent
PASS Published package is consistent and attested §1.3
Package is consistent with its source and carries provenance attestation. 6 findings
  • Package: @modelcontextprotocol/server-filesystem@2026.7.10 ↗
  • Ecosystem: npm
  • Age: 611 days
  • Weekly downloads: 471726
  • Repo field matches source repo: true
  • Build-provenance attestation: present
PASS Tool surface is inspectable and proportionate §2.1–§2.4
Package source scanned. Capabilities detected: filesystem. Reported as capability risk (§2.4); whether each is essential to the server's stated purpose is §2.3 and remains a manual judgement. 5 findings
  • filesystem (filesystem write/delete): dist/index.js
  • filesystem (fs module import): dist/index.js
  • filesystem (filesystem write/delete): dist/roots-utils.js
  • filesystem (fs module import): dist/roots-utils.js
  • Detected capabilities: filesystem
INFO Transport & authentication §3

Local (stdio) server: runs with host-process privileges by design. Transport checks apply to remote servers; scrutiny shifts to §1/§2.
FAIL No known vulnerabilities (OSV.dev) §4.1
2 advisory(ies) on record for @modelcontextprotocol/server-filesystem @2026.7.10 (npm) - review whether the evaluated version is affected. 2 findings
  • GHSA-hc55-p739-j48w: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix ↗
  • GHSA-q66q-fx2p-7w4m: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling ↗
PASS Server-supplied instructions free of poisoning indicators §5.1–§5.4

No poisoning indicators found across 14 server-supplied text item(s).

Verify manually - the scoring model can’t judge these for you

  • §2.3 - Is the tool surface no broader than the server’s stated purpose requires?
  • §3.4 - For stdio servers: which environment credentials does it read, and are they scoped rather than org-wide tokens?
  • §6.1 - Cross this server’s capabilities with your already-connected servers: any read-capability × send-capability pairs need explicit sign-off.
  • §6.2 - Run the connecting agent with sandboxing and egress controls sized to the combined tool surface, not just this server’s.

Methodology: MCP Server Security Policy. Checks and scoring weights are open source. Unfamiliar term? See the glossary.