FilesystemSAFE
A Model Context Protocol (MCP) server for platform-agnostic file capabilities, including advanced search/replace and directory tree traversal
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.typescriptlang.org/) [](https://modelcontextprotocol.io/) []() [](https://opensource.org/licenses/Apache-2.0) []() [](https://github.com/cyanheads/filesystem-mcp-server)
Empower your AI agents with robust, platform-agnostic file system capabilities, now with STDIO & Streamable HTTP transport options.
This Model Context Protocol (MCP) server provides a secure and reliable interface for AI agents to interact with the local filesystem. It enables reading, writing, updating, and managing files and directories, backed by a production-ready TypeScript foundation featuring comprehensive logging, error handling, security measures, and now supporting both STDIO and HTTP transports.
Table of Contents
- Overview
- Features
- Installation
- Configuration
- Usage with MCP Clients
- Available Tools
- Project Structure
- Development
- License
Overview
The Model Context Protocol (MCP) is a standard framework allowing AI models to securely interact with external tools and data sources (resources). This server implements the MCP standard to expose essential filesystem operations as tools, enabling AI agents to:
- Read and analyze file contents.
- Create, modify, or overwrite files.
- Manage directories and file paths.
- Perform targeted updates within files.
Built with TypeScript, the server emphasizes type
eb9b262c6f07OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add filesystem-mcp-server -- npx -y @cyanheads/[email protected]
{
"mcpServers": {
"filesystem-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/[email protected]"
]
}
}
}Exposed tools (10)
3 read · 5 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
copy_path | read | |
create_directory | write | |
delete_directory | destructive | |
delete_file | destructive | |
list_files | read | |
move_path | write | |
read_file | read | |
set_filesystem_default | write | |
update_file | write | |
write_file | write |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
delete_directory, delete_file
.clinerules
import { BaseErrorCode, McpError } from '../../../types-global/errors.js';import { logger } from '../../../utils/internal/logger.js';import { RequestContext } from '../../../utils/internal/requestContext.js';import { serverState } from '../../state.js';import { BaseErrorCode, McpError } from '../../../types-global/errors.js';@google/genai, @modelcontextprotocol/sdk, @types/jsonwebtoken, @types/node, @types/sanitize-html, chalk, chrono-node, cli-table3
Gates applied: no_behavioural_pass.
eb9b262c6f07full audit observations/trust-audit/mcp-server/cyanheads__filesystem-16.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | eb9b262c6f07 | SAFE | B | 89 | first audit |
Questions
What is the Filesystem MCP server?
A Model Context Protocol (MCP) server for platform-agnostic file capabilities, including advanced search/replace and directory tree traversal
What tools does Filesystem expose?
10 in total: 3 read-only, 5 that write, and 2 that can delete or overwrite (delete_directory, delete_file). Every one is listed on this page with its risk.
Is Filesystem safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Filesystem need?
No credential environment variables were found in its source, so it appears to need none.
How does Filesystem run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @cyanheads/filesystem-mcp-server at 1.0.4.
How current is this page?
The grade is for one exact copy of the source (eb9b262c6f07), read on 2026-10-08. The repository is watched and re-audited when it changes.