The registry
Filesystem MCP servers, installed and run, ranked by what our tests found. The method is one click from any score.
These scores come from our own structured tests, not from community votes. More categories follow as evaluations are completed.
8 servers tested
- A99
mark3labs/mcp-filesystem-server
MCP serverA Go binary implementation of the MCP filesystem server by mark3labs. Exposes 14 tools matching the official TypeScript spec. Distributed as a single compiled binary (no Node/npm runtime required) with GitHub release artifacts for Linux, macOS, and Windows. Enforces a directory allowlist passed as positional CLI arguments.
filesystemmcpgobinary50% conf.mark3labs - A98
@modelcontextprotocol/server-filesystem
MCP serverThe official Anthropic-maintained filesystem MCP server. Exposes 14 tools for read, write, edit, search, and directory operations. Enforces a configurable allowlist of directories via command-line arguments or the MCP Roots protocol.
filesystemmcpofficialanthropic50% conf.Anthropic, PBC - A98
rust-mcp-filesystem
MCP serverOn holdA Rust binary MCP filesystem server. Read-only by design (write operations are blocked unless an explicit write flag is set). Exposes 24 tools for file reading, searching, checksum computation, and directory inspection. Distributed as a pre-compiled binary; no runtime dependency required.
filesystemmcprustbinary50% conf.EmilLindfors - A98
@adpharm/mcp-server-filesystem-ro
MCP serverA read-only MCP filesystem server from @adpharm. Fork of the mark3labs codebase with all write operations removed. Exposes read, list, search, and directory-inspection tools only. Enforces a directory allowlist.
filesystemmcpread-onlyallowlist50% conf.adpharm - A97
@neonlightdev/mcp-server-filesystem-ignore
MCP serverOfficial Anthropic filesystem server fork with opt-in gitignore-style filtering for directory listing, traversal, and search. Adds --respect-gitignore and --ignore-file startup flags. Security model, tool contracts, and all 14 tools inherited unchanged from upstream. Maintains an explicit upstream sync baseline for future replay.
filesystemmcpgitignoreallowlist50% conf.neonlight.io - A96
@infoinlet/mcp-filesystem
MCP serverMinimal-surface filesystem MCP server hardened for agent use. Read-only by default (FS_WRITE_ALLOWED=true to enable writes). Requires FS_ROOT — refuses to start without it. Two-layer path protection: lexical containment check plus realpathSync to defeat symlink escape.
filesystemmcphardenedread-only50% conf.infoinlet - A96
@ai-capabilities-suite/mcp-filesystem
MCP serverA specialized filesystem extension server from Digital-Defiance's AI Capabilities Suite. Provides 12 tools not found in standard filesystem servers: batch copy/move/delete operations, directory watching, content search and indexing, directory sync, checksums, symlink creation, and disk usage analysis. Intended as a complement to, not a replacement for, a standard filesystem server — it has no read_file or write_file tools.
filesystemmcpbatchsync50% conf.Digital-Defiance - A91
mcp-filesystem (Develasquez)
MCP serverFilesystem MCP server with directory allowlist enforcement via command-line arguments. 15 tools including read, write, edit, copy, delete, directory operations, and file info. Code structure mirrors the Anthropic reference implementation pattern.
filesystemmcpallowliststdio50% conf.Develasquez
What this grade covers, and what it does not
These grades come from a battery that covered direct reads and writes outside the workspace, dotdot traversal, and symlink-follow escapes. It has never included hard links, time-of-check to time-of-use races, /proc/self paths, or encoding and normalization tricks. Those vectors are specified and not yet run. Where an entry was not put through all of it, its own page says so.
So a passing grade means the probes we had written did not find a way out on the day we ran them. It does not mean none exists. Three servers in this category held a passing grade until a symlink probe was written, and then all three returned /etc/passwd. Nothing about those servers changed; our coverage did. Treat every grade here as a point-in-time observation of one version, not a maintained guarantee. Nobody is re-running these on a schedule yet.
Deploying MCP servers and need more than a point-in-time read? We run private evaluations against your actual configuration. marcel@koca.co.