Is Filesystem MCP server safe?

An MCP tool exposes a powerful capability (files, shell, network, browser, or credentials).

server.registerTool("read_file", {

server.registerTool("write_file", {

server.registerTool("edit_file", {

server.registerTool("list_directory", {

server.registerTool("list_directory_with_sizes", {

Why it matters: Wired into an agent, these grant it real access to your machine — confirm each is required.

Fix: Confirm each powerful tool is required and constrained; broad MCP tools (shell/filesystem/network) grant an agent significant host access.

The component reads files from disk.

return await fs.readFile(filePath, encoding);

const content = normalizeLineEndings(await fs.readFile(filePath, 'utf-8'));

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

await fs.writeFile(filePath, content, { encoding: "utf-8", flag: 'wx' });

await fs.writeFile(tempPath, content, 'utf-8');

await fs.unlink(tempPath);

await fs.writeFile(tempPath, modifiedContent, 'utf-8');

await fs.unlink(tempPath);

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

package.json has a 'prepare' script (runs on git/local installs and before publishing).

"prepare": "npm run build",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

An MCP tool surface (manifest or tool definitions) was found.

const server = new McpServer({

server.registerTool("read_file", {

server.registerTool("read_text_file", {

server.registerTool("read_media_file", {

server.registerTool("read_multiple_files", {

server.registerTool("write_file", {

server.registerTool("edit_file", {

server.registerTool("create_directory", {

server.registerTool("list_directory", {

server.registerTool("list_directory_with_sizes", {

server.registerTool("directory_tree", {

server.registerTool("move_file", {

server.registerTool("search_files", {

server.registerTool("get_file_info", {

server.registerTool("list_allowed_directories", {

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.