AgentArmor
B

B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

App connector · Files & documents, Cloud & infrastructure

@modelcontextprotocol/server-filesystem

MCP server for filesystem access

Bottom line: Signal-based grade (4/7 points): heavily downloaded, listed in several sources, public source code. This reflects adoption and transparency, not a code review.

Popularity score
52/100
Rank
#94 of 500
Weekly downloads
584k

What it does

This MCP server enables AI agents to read, write, and manage files on a local filesystem through the Model Context Protocol standard. It acts as a bridge between Claude and other AI models, allowing them to interact with your computer's file system as a capability.

Who it’s for

Developers and enterprises building AI agents that need file system access for document processing, log analysis, code editing, or data pipeline tasks. Teams using Claude Desktop or MCP-compatible platforms who want to safely sandbox filesystem operations.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

Install via npm:

npm install @modelcontextprotocol/server-filesystem

For Claude Desktop, add to your claude_desktop_config.json:

json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/allowed/directory"]
    }
  }
}

Verify against the official repository README (opens external site) for latest configuration options and security constraints.

Risks

  • Unrestricted filesystem scope: If not properly configured with directory constraints, an AI agent could read/write sensitive files, credentials, or system files outside intended boundaries.
  • Prompt injection attacks: Malicious prompts could potentially manipulate the agent into performing unintended file operations (deletion, overwrite, exfiltration).
  • Data exfiltration: AI models could inadvertently leak file contents (including secrets, PII, or proprietary data) in responses or logs if access controls are misconfigured.
  • Supply chain risk: Dependencies and updates could introduce vulnerabilities; verify the official MCP GitHub organization maintains this server.
  • Credential exposure in files: Agents with access to config files, .env files, or source code may expose API keys or secrets if not explicitly redacted.

How to stay secure

Least-privilege permissions

  • Restrict filesystem scope to a single, isolated directory tree using the roots configuration parameter; never grant access to /, /home, or system directories.
  • Disable write operations if only read access is needed; configure allow_write: false in the MCP server settings.
  • Use read-only file mounts (e.g., ro flag in container/VM environments) for non-editable data directories to prevent accidental or injected modifications.
  • Exclude sensitive files by explicitly blocklisting paths containing .env, .ssh, credentials, secrets, or application config files via path filtering rules.

Network isolation

  • Run the MCP server in a sandboxed environment (container, VM, or restricted user account) with no outbound network access unless explicitly required.
  • Disable or restrict subprocess execution if the filesystem server has shell command capabilities; verify allow_exec: false or equivalent is set.
  • Bind to localhost only if the server exposes a network interface; use 127.0.0.1 or Unix sockets, never 0.0.0.0.

Monitoring

  • Log all file access operations (read, write, delete) with timestamps, file paths, and initiating agent/user; ship logs to a centralized, immutable audit system.
  • Alert on suspicious patterns: rapid file enumeration, access to blocklisted paths, bulk writes, or operations outside normal working hours.
  • Verify MCP server version regularly against the official @modelcontextprotocol GitHub (opens external site) repository and update immediately upon security releases.

Red flags to watch for

  • Agent requests to access parent directories (e.g., ../, ../../) or absolute paths outside the configured roots scope—reject immediately.
  • Attempts to read/write files with sensitive names (.env, id_rsa, credentials.json, config.yaml) or in system paths (/etc, /var, /proc).
  • Unusual file operations in rapid succession (mass deletion, bulk compression) or file exfiltration via encoding/base64 output in agent responses.
  • Outdated or pinned dependency versions; verify package.json or lock files reference the latest stable release from the official MCP organization.

Alternatives

Sources

Related files & documents skills

ARank #2

context7

App connector · Files & documents, Memory & knowledge

Context7 Platform -- Up-to-date docs for AI agents

Popularity score: 98/100 63.1k stars1.2M weekly downloads

ARank #9

codebase-memory-mcp

App connector · Developer tools, Cloud & infrastructure

High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 162 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.

Popularity score: 82/100 46.7k stars8k weekly downloads

ARank #11

mcp-use

AI agent skill · Communication, Cloud & infrastructure

The fullstack MCP framework to develop MCP Apps for ChatGPT / Claude & MCP Servers for AI Agents.

Popularity score: 80/100 10.8k stars37.3k weekly downloads