FTP AccessBLOCK
Model Context Protocol server for FTP access
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mseep.ai/app/alxspiker-mcp-server-ftp)
[](https://smithery.ai/servers/alxspikers-team/mcp-server-ftp)
This Model Context Protocol (MCP) server provides file-management tools for FTP, FTPS, and SFTP servers. It supports directory listing, binary-safe downloads/uploads, text edits, appends, renames/moves, directory creation, and deletion.
Protocol support
- FTP — traditional FTP, normally on port 21.
- FTPS — FTP secured with TLS. Use
FTP_PROTOCOL=ftpandFTP_SECURE=true. - SFTP — SSH File Transfer Protocol, normally on port 22. SFTP is a different protocol from FTPS and is already encrypted by SSH, so
FTP_SECUREdoes not apply to it.
Features
- List files and directories
- Download and upload text or binary files
- Edit exact text in remote files
- Append to files
- Rename or move files/directories
- Create and delete directories
- FTP, FTPS, and SFTP support
- SFTP password or SSH private-key authentication
- Optional 1Password CLI private-key resolution
- AES-256-GCM encrypted credential values
- OS-keychain support for the encryption key
Installation
Installing via Smithery
npx -y @smithery/cli install alxspikers-team/mcp-server-ftp --client claude
Prerequisites
- Node.js 18.14 or newer
- An MCP-compatible client such as Claude Desktop
Installing via npm
The server is published as `mcp-server-ftp`:
{
"mcpServers": {
"ftp-server": {
"command": "npx",
"args": ["-y", "mcp-server-ftp"],
"env": {
"FTP_HOST": "ftp.example.com"
}
}
}
}Building from source
git clone https://github.com/alxspiker/mcp-server-ftp.git cd mcp-server-ftp npm install npm run build
Config
2dac512c11e0OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server-ftp --env FTP_ENCRYPTION_KEY=${FTP_ENCRYPTION_KEY} --env FTP_PASSPHRASE=${FTP_PASSPHRASE} --env FTP_PASSWORD=${FTP_PASSWORD} --env FTP_PRIVATE_KEY_PATH=${FTP_PRIVATE_KEY_PATH} -- npx -y [email protected]{
"mcpServers": {
"mcp-server-ftp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FTP_ENCRYPTION_KEY": "${FTP_ENCRYPTION_KEY}",
"FTP_PASSPHRASE": "${FTP_PASSPHRASE}",
"FTP_PASSWORD": "${FTP_PASSWORD}",
"FTP_PRIVATE_KEY_PATH": "${FTP_PRIVATE_KEY_PATH}"
}
}
}
}Exposed tools (9)
3 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
append-file | read | |
create-directory | write | |
delete-directory | destructive | |
delete-file | destructive | |
download-file | read | |
edit-file | write | |
list-directory | read | |
rename-file | write | |
upload-file | write |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
SFTP private-key path (for example ~/.ssh/id_ed25519) or a 1Password
op:// secret reference. Leave empty to auto-detect common ~/.ssh keys.
const DEFAULT_KEY_PATHS = ["~/.ssh/id_ed25519", "~/.ssh/id_rsa", "~/.ssh/id_ecdsa"];
delete-directory, delete-file
const list = await new FtpClient({ ...config, rejectUnauthorized: false }).listDirectory("/");@modelcontextprotocol/sdk, basic-ftp, ssh2-sftp-client, zod, @types/node, @types/ssh2-sftp-client, ftp-srv, selfsigned
Gates applied: no_behavioural_pass.
2dac512c11e0full audit observations/trust-audit/mcp-server/alxspiker__ftp-access.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 2dac512c11e0 | BLOCK | D | 69 | first audit |
Questions
What is the FTP Access MCP server?
Model Context Protocol server for FTP access
What tools does FTP Access expose?
9 in total: 3 read-only, 4 that write, and 2 that can delete or overwrite (delete-directory, delete-file). Every one is listed on this page with its risk.
Is FTP Access safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does FTP Access need?
It reads FTP_ENCRYPTION_KEY, FTP_PASSPHRASE, FTP_PASSWORD, FTP_PRIVATE_KEY_PATH and FTP_TLS_REJECT_UNAUTHORIZED from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does FTP Access run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-server-ftp at 1.2.3.
How current is this page?
The grade is for one exact copy of the source (2dac512c11e0), read on 2026-10-09. The repository is watched and re-audited when it changes.