Evaluation record · mcp-server-filesystem

MCP Filesystem Server

v2026.7.4

Anthropic

MCPfile-systemlocalmcpmodel-context-protocol

Strong

About This MCP

Official MCP reference server providing AI models with controlled access to the local filesystem (file reading, writing, and directory operations). One of seven reference servers still maintained after the 2025-05-29 archival of non-core servers; MCP governance moved to the Agentic AI Foundation (Linux Foundation) on 2025-12-09, latest stable spec 2025-11-25 (2026-07-28 revision at release-candidate stage). Critical for file-based workflows but requires careful security configuration.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

file operation accuracy

File operation testing across multiple platforms

Evidence

MCP Documentation — Direct filesystem operations with high accuracy and reliability

highVerified: 2026-07-09

response time

Latency benchmarking

Evidence

MCP Performance Testing — Local filesystem operations complete in milliseconds

highVerified: 2026-07-09

error handling

Error scenario testing

Evidence

MCP Server Implementation — Comprehensive error handling for permissions, disk space, and invalid paths

highVerified: 2026-07-09

cross platform compatibility

Multi-platform testing

Evidence

MCP GitHub Repository — Supports Windows, macOS, and Linux with platform-specific path handling

highVerified: 2026-07-09

large file handling

Large file performance testing

Evidence

Community Testing — Handles large files efficiently with streaming support

mediumVerified: 2026-07-09

🛡️Security

access control

Access control testing

Evidence

MCP Security Documentation — Requires explicit directory allowlist configuration, but enforcement depends on setup

highVerified: 2026-07-09

path traversal protection

Path traversal attack testing

Evidence

MCP Server Code — Built-in path normalization prevents basic traversal attacks

GitHub Advisory Database / Trend Micro disclosure — CVE-2025-53110 (directory containment bypass, CVSS 7.3) and CVE-2025-53109 (symlink bypass, CVSS 8.4) were disclosed by Trend Micro in 2025 and fixed in release 2025.7.1; no newer advisories against this server found as of 2026-07-09 (current release 2026.7.4)

highVerified: 2026-07-09

permission enforcement

Permission boundary testing

Evidence

Security Analysis — Relies on OS-level permissions; AI can request any file within allowed directories

mediumVerified: 2026-07-09

audit logging

Logging capabilities review

Evidence

MCP Logging — Basic operation logging available, detailed audit logs require custom implementation

mediumVerified: 2026-07-09

data exfiltration risk

Data flow analysis

Evidence

Security Review — AI models have read access to all allowed directories; sensitive data exposure risk

highVerified: 2026-07-09

🔒Privacy & Compliance

data exposure control

Data flow analysis

Evidence

MCP Architecture — File contents sent to LLM provider; requires careful directory scope configuration

highVerified: 2026-07-09

pii protection

Privacy features assessment

Evidence

MCP Security Guidelines — No built-in PII detection or redaction; responsibility on developer

mediumVerified: 2026-07-09

local processing

Data processing architecture review

Evidence

MCP Architecture — Server runs locally, but file content is transmitted to LLM API

highVerified: 2026-07-09

gdpr compliance

Compliance framework review

Evidence

MCP Documentation — GDPR compliance depends on LLM provider and user configuration

mediumVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

MCP Docs — Comprehensive documentation with clear setup instructions and examples

highVerified: 2026-07-09

operation visibility

Logging capabilities assessment

Evidence

MCP Protocol — All filesystem operations visible in MCP message logs

highVerified: 2026-07-09

open source code

Source code review

Evidence

GitHub Repository — Fully open source with MIT license, code auditable

highVerified: 2026-07-09

security guidance

Security documentation review

Evidence

MCP Security Docs — Provides security best practices but could be more comprehensive

mediumVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment

Evidence

MCP Quickstart — Simple npm/pip installation with minimal configuration

highVerified: 2026-07-09

resource efficiency

Resource utilization testing

Evidence

Performance Testing — Minimal CPU and memory overhead for file operations

highVerified: 2026-07-09

stability

Issue tracking analysis

Evidence

Community Reports — Stable operation with few reported bugs

highVerified: 2026-07-09

maintenance requirements

Maintenance overhead assessment

Evidence

MCP Server Updates — Regular updates, minimal maintenance required

Anthropic - Donating MCP to the Agentic AI Foundation — filesystem is one of the seven reference servers still actively maintained after the 2025-05-29 archival; MCP governance moved to the Agentic AI Foundation under the Linux Foundation on 2025-12-09

npm - @modelcontextprotocol/server-filesystem — Latest release 2026.7.4 (published 2026-07-04); still listed among the seven maintained reference servers in modelcontextprotocol/servers README (repo ~88,300 stars, not archived)

mediumVerified: 2026-07-09

community support

Community activity analysis

Evidence

GitHub Discussions — Growing community support, relatively new protocol (late 2024)

mediumVerified: 2026-07-09

Strengths

+Fast, local file operations with minimal latency
+Cross-platform support (Windows, macOS, Linux)
+Simple setup and configuration
+Open source and fully auditable code
+Comprehensive documentation from Anthropic
+Efficient handling of large files with streaming support

Limitations

!Significant security risk if misconfigured - AI can access all allowed files
!No built-in PII or sensitive data detection/redaction
!File contents sent to external LLM provider APIs, with potential for accidental data exfiltration
!Limited granular permission controls beyond directory allowlists
!Audit logging requires custom implementation for compliance needs
!SECURITY: CVE-2025-53110 (containment bypass) and CVE-2025-53109 (symlink bypass) fixed in 2025.7.1; versions older than 2025.7.1 remain vulnerable - upgrade to current release
!STATUS 2026-07-09: actively maintained reference server (one of 7 retained after the 2025-05-29 archival); latest npm release 2026.7.4 (2026-07-04); governance under the Agentic AI Foundation (Linux Foundation, 2025-12-09)

Metadata

license: MIT

supported platforms

0: Windows

1: macOS

2: Linux

programming languages

0: TypeScript

1: Python

mcp version: 1.0

github repo: https://github.com/modelcontextprotocol/servers

github stars: 88259

first release: 2024-11

maintained by: MCP project (Agentic AI Foundation / Linux Foundation since 2025-12-09)

status: Official - Active

transport types

0: stdio

installation methods

0: npm

Use Case Ratings

code generation

Excellent for code generation workflows requiring file reading and writing

customer support

Limited utility for customer support; mainly for loading reference documents

content creation

Good for content workflows involving file-based templates and outputs

data analysis

Useful for loading data files, but limited analysis capabilities

research assistant

Excellent for accessing research papers, documents, and notes

legal compliance

Useful for document access but requires strict security controls

healthcare

High risk due to PHI exposure; requires careful configuration and HIPAA controls

financial analysis

Risky for sensitive financial data; requires strict directory restrictions

education

Good for accessing educational materials and student work

creative writing

Excellent for managing drafts, outlines, and creative project files