MCP Verdict
Back to the registry

rust-mcp-filesystem

MCP serverVerified · Rung 3
A98

A Rust binary MCP filesystem server. Read-only by design (write operations are blocked unless an explicit write flag is set). Exposes 24 tools for file reading, searching, checksum computation, and directory inspection. Distributed as a pre-compiled binary; no runtime dependency required.

RepositoryHomepage

Caveat

Non-standard tool name: the read tool is read_text_file, not the conventional read_file. Agent prompts or tool-call templates that hardcode the standard name will fail until updated. Does not affect the score.

Score breakdown

Functional100/100
Reliability95/100
Latency100/100
Security98/100
Confidencelow · 50%

Based on 1 evaluation. Confidence rises as more independent tests agree.

Method rung1.v1tested Jun 8, 2026 (2 months ago)How we score

The verdict

A Rust binary filesystem MCP server that is read-only by default. All path-boundary checks pass: traversal attempts and direct /etc/passwd reads are blocked. Write operations return errors in the default (read-only) configuration. Note: the read tool is named read_text_file rather than the conventional read_file; any agent prompt or tool-call template that hardcodes the standard name will need updating. With 24 tools including checksum, diff, and advanced search capabilities, this server is the most feature-rich read-only option in the category. No security concerns beyond the non-standard tool name (INFO).

What this grade covers, and what it does not

This server was tested on Jun 8, 2026, 2 months ago, against the version pinned on this page. It was not put through the whole battery. Its grade is on hold because a vector in the standard set was never run against this server, and which one is in the hold notice above. The standard set is direct reads and writes outside the workspace, dotdot traversal, and symlink-follow escapes. It has never included hard links, time-of-check to time-of-use races, /proc/self paths, or encoding and normalization tricks. Those vectors are specified and not yet run against anything.

So a passing grade means the probes we had written did not find a way out on the day we ran them. It does not mean none exists. Three servers in this category held a passing grade until a symlink probe was written, and then all three returned /etc/passwd. Nothing about those servers changed; our coverage did. Treat every grade here as a point-in-time observation of one version, not a maintained guarantee. Nobody is re-running these on a schedule yet.

Deploying MCP servers and need more than a point-in-time read? We run private evaluations against your actual configuration. marcel@koca.co.

Security findings

Flags from our evaluations, ordered by severity.

  • Info

    NONSTANDARD_READ_TOOL_NAME

    The read tool is named read_text_file instead of the ecosystem-standard read_file. Any agent configuration or prompt template that references the conventional name will silently fail to invoke it. Not a security issue, but an integration friction point: callers must use the correct name.

Test history

1 run

Every evaluation behind the score. This is the receipt.

  1. Passmanual
    Reliability

    95/100

    Latency

    3 ms

    Setup

    Easy

    Flags

    1

    24 tools verified via stdio NDJSON in a Linux arm64 sandbox (pre-compiled binary v0.4.2 from GitHub releases). Key tools: read_text_file, read_multiple_text_files, list_directory, directory_tree, search_files, get_file_info, compute_file_checksum, diff_files. read_text_file correctly reads allowed files. Traversal attempt blocked. /etc/passwd read blocked. write_file blocked (read-only default). The tool name read_text_file is non-standard (the ecosystem convention is read_file); this is an INFO flag, not a security issue. zip_files fails in read-only mode as expected.

    InfoNONSTANDARD_READ_TOOL_NAME