MCP Verdict
Back to the registry

@ai-capabilities-suite/mcp-filesystem

MCP serverVerified · Rung 3
A96

A specialized filesystem extension server from Digital-Defiance's AI Capabilities Suite. Provides 12 tools not found in standard filesystem servers: batch copy/move/delete operations, directory watching, content search and indexing, directory sync, checksums, symlink creation, and disk usage analysis. Intended as a complement to, not a replacement for, a standard filesystem server — it has no read_file or write_file tools.

RepositoryHomepage

Score breakdown

Functional100/100
Reliability88/100
Latency100/100
Security98/100
Confidencelow · 50%

Based on 1 evaluation. Confidence rises as more independent tests agree.

Method rung1.v1tested Jun 9, 2026 (2 months ago)How we score

The verdict

Specialized extension server with 12 tools for batch operations, directory sync, watching, and disk analysis. Intended as a complement to, not a replacement for, a standard server — it has no read_file or write_file tools. All workspace-boundary security tests pass when the workspace root is correctly configured via MCP_FILESYSTEM_WORKSPACE_ROOT. fs_copy_directory, fs_sync_directory, and fs_batch_operations (copy/move/delete) all call validatePath() on both source and destination, throwing WORKSPACE_BOUNDARY_VIOLATION for any path outside the configured root. The security audit log on stderr confirms violations are detected and rejected. A previous eval (2026-06-08) incorrectly assigned a HIGH COPY_SYNC_DESTINATION_ESCAPE and grade F. The root cause was a methodology error: MCP_FILESYSTEM_WORKSPACE_ROOT was not explicitly set, so the server defaulted to process.cwd() (/tmp). The test destination (/tmp/outside/escaped) was a subdirectory of /tmp, hence inside the configured root. The server correctly allowed the copy. Retested 2026-06-09 with root=/tmp/aics_root/ws and destination=/tmp/aics_outside — verified via realpath() that the destination is genuinely outside before asserting a result. All three tools (fs_copy_directory, fs_sync_directory, fs_batch_operations) block the operation with WORKSPACE_BOUNDARY_VIOLATION. One INFO finding: fs_search_files accepts a searchPath outside the workspace without raising WORKSPACE_BOUNDARY_VIOLATION — it returns {results: [], count: 0}. Tested with a searchPath containing a file matching the search pattern; 0 results returned, no content disclosed.

What this grade covers, and what it does not

This server was tested on Jun 9, 2026, 2 months ago, against the version pinned on this page. The battery covered direct reads and writes outside the workspace, dotdot traversal, and symlink-follow escapes. It has never included hard links, time-of-check to time-of-use races, /proc/self paths, or encoding and normalization tricks. Those vectors are specified and not yet run.

So a passing grade means the probes we had written did not find a way out on the day we ran them. It does not mean none exists. Three servers in this category held a passing grade until a symlink probe was written, and then all three returned /etc/passwd. Nothing about those servers changed; our coverage did. Treat every grade here as a point-in-time observation of one version, not a maintained guarantee. Nobody is re-running these on a schedule yet.

Deploying MCP servers and need more than a point-in-time read? We run private evaluations against your actual configuration. marcel@koca.co.

Security findings

Flags from our evaluations, ordered by severity.

  • Info

    SEARCH_ACCEPTS_OUTSIDE_PATH_SILENTLY

    fs_search_files accepts a searchPath outside the workspace root without returning a WORKSPACE_BOUNDARY_VIOLATION error and without logging a security audit event. Returns {status: success, results: [], count: 0}. Tested with searchPath=/etc (pattern=passwd) and searchPath=/tmp/aics_outside (pattern=*.txt, with a matching file present) — both return 0 results, no content disclosed. Behavior is consistent with silent bounding to the workspace, but the absence of an explicit error could mask misconfiguration.

Test history

1 run

Every evaluation behind the score. This is the receipt.

  1. Passmanual
    Reliability

    88/100

    Latency

    3 ms

    Setup

    Easy

    Flags

    1

    12 tools verified via stdio NDJSON in a Node v22 sandbox (npm @0.1.9). Tools: fs_batch_operations, fs_watch_directory, fs_get_watch_events, fs_stop_watch, fs_search_files, fs_build_index, fs_create_symlink, fs_compute_checksum, fs_verify_checksum, fs_analyze_disk_usage, fs_copy_directory, fs_sync_directory. Baseline copy inside workspace succeeds: {status: success, filesCopied: 1}. Server has no read_file or write_file — it is an extension server.

    InfoSEARCH_ACCEPTS_OUTSIDE_PATH_SILENTLY