MCP Verdict
Back to the registry

@modelcontextprotocol/server-filesystem

MCP serverVerified · Rung 3
A98

The official Anthropic-maintained filesystem MCP server. Exposes 14 tools for read, write, edit, search, and directory operations. Enforces a configurable allowlist of directories via command-line arguments or the MCP Roots protocol.

RepositoryHomepage

Score breakdown

Functional100/100
Reliability95/100
Latency100/100
Security98/100
Confidencelow · 50%

Based on 1 evaluation. Confidence rises as more independent tests agree.

Method rung1.v1tested Jun 7, 2026 (2 months ago)How we score

The verdict

The reference implementation. All 14 advertised tools pass functional testing. Directory allowlist is enforced at startup and at every operation: both read and write outside allowed directories are blocked with a clear error. Setup is a single npx command. The only design note worth flagging: the server grants full read-write access to every allowed directory with no per-directory read-only mode at the server level. Use Docker volume mounts with the ro flag if you need a read-only allowed directory. For any production agent deployment, this is the server to start with.

What this grade covers, and what it does not

This server was tested on Jun 7, 2026, 2 months ago, against the version pinned on this page. The battery covered direct reads and writes outside the workspace, dotdot traversal, and symlink-follow escapes. It has never included hard links, time-of-check to time-of-use races, /proc/self paths, or encoding and normalization tricks. Those vectors are specified and not yet run.

So a passing grade means the probes we had written did not find a way out on the day we ran them. It does not mean none exists. Three servers in this category held a passing grade until a symlink probe was written, and then all three returned /etc/passwd. Nothing about those servers changed; our coverage did. Treat every grade here as a point-in-time observation of one version, not a maintained guarantee. Nobody is re-running these on a schedule yet.

Deploying MCP servers and need more than a point-in-time read? We run private evaluations against your actual configuration. marcel@koca.co.

Security findings

Flags from our evaluations, ordered by severity.

  • Info

    NO_PER_DIR_READONLY

    All allowed directories are granted full read-write access. There is no server-level per-directory read-only mode. Mitigation: use Docker volume mount with 'ro' flag when a read-only allowed directory is needed.

Test history

1 run

Every evaluation behind the score. This is the receipt.

  1. Passmanual
    Reliability

    95/100

    Latency

    4 ms

    Setup

    Trivial

    Flags

    1

    All 14 tools verified via stdio MCP protocol in sandbox (Node v22, npm package v2026.1.14). Tested: read_text_file, read_multiple_files, write_file, edit_file, create_directory, list_directory, list_directory_with_sizes, directory_tree, move_file, search_files, get_file_info, list_allowed_directories. All return correct results. Tool annotations (readOnlyHint, destructiveHint, idempotentHint) present and accurate.

    InfoNO_PER_DIR_READONLY