Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 5
- 3 5
- 2 4
- 1 0
Trust in production
- Trust it - 14%
- With caveats - 64%
- Wouldn't - 21%
43% would recommend this server
How reviewers scored it
- Setup & docs 3.0
- Auth experience 2.6
- Reliability 3.3
- Maintainer responsiveness 3.6
Why it got a D
The official reference server, and very active. Five of its six path-escape advisories since 2025 are fully fixed (use 2.2.0 or later; date versions such as 2026.8.31 won't be patched, and package managers won't offer the upgrade). The sixth is still open on Windows, so there don't allow a folder that another user or an untrusted process can write to. Pass only the directories it needs, and add --read-only if it needn't write. Biggest deduction: there is no login, so anything that can steer the model can change files in those directories.
How to connect
// .vscode/mcp.json (README NPX config)
{ "servers": { "filesystem": { "command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "${workspaceFolder}"] } } }// claude_desktop_config.json (README NPX config)
{ "mcpServers": { "filesystem": { "command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem",
"/Users/username/Desktop", "/path/to/other/allowed/dir"] } } }Is Filesystem MCP Server safe?
Is Filesystem MCP Server safe to use?
Filesystem MCP Server grades D (notable weaknesses - review closely). There is no login: anything that can start or reach it gets its full access. It has 1 open CVE. Check the advisories before you install. It runs locally over stdio, so it acts with your machine's access.
Does Filesystem MCP Server have known vulnerabilities?
Yes, 1 open CVE in our data. The listing above explains what they affect and what to run instead.
Does Filesystem MCP Server support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/filesystem-mcp-server)<a href="https://trustedmcp.io/servers/filesystem-mcp-server"><img src="https://trustedmcp.io/badge/filesystem-mcp-server.svg" alt="TrustedMCP grade D" height="80"></a>Community reviews
Security story needs work
Setup was rough and the result was flaky. There is no auth layer, so whatever can reach it can use it. I keep it local only. I will check back in a few releases.
Used for Internal developer assistant
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Too many sharp edges
Gave it a fair shot over two weeks. Being official from MCP steering group counts for a lot when I pitch it to security. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Releases come often and the changelog is clear. Keeping it to local experiments for now.
Used for Generating boilerplate from existing patterns
- Setup & docs 3/5
- Auth experience 1/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Useful, with a few rough edges
Took longer to configure than I expected. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Recommended, with sensible guardrails.
Used for CI failure investigation
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Exactly what I needed from Filesystem
Tried it on a side project first, then rolled it out at work. You can tell it is actively maintained, the rough edges keep getting fixed. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Fine in production if you sandbox it.
Used for Scripting routine maintenance tasks
- Setup & docs 5/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Not ready for anything that matters
It works in a demo, but things got shaky under real use. Read-only mode is the first thing I enable, and it covers most of what I need. The past CVEs put me off at first. The fixed releases have been fine, just keep it updated. I would use it in prod, but only with a human approving writes.
Used for Generating boilerplate from existing patterns
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Earned a permanent spot in my config
Started with it as an experiment, now it is a fixture. Check the advisories on the listing before installing an older version from a tutorial. Local stdio process, easy to start and stop from the client. Read-only mode is the first thing I enable, and it covers most of what I need. Would recommend without hesitation.
Used for Scripting routine maintenance tasks
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Of the Filesystem integrations I tried, this one is the most predictable. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. The past CVEs put me off at first. The fixed releases have been fine, just keep it updated. Worth it, just do not skip the hardening steps.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 3/5
No complaints after a month
Our agents call this dozens of times a day. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Nice to use something maintained by MCP steering group rather than a random fork. It is in our production agent and I sleep fine.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Worth the five minutes to set up
Been running this for about a month now. Being official from MCP steering group counts for a lot when I pitch it to security. I would use it in prod, but only with a human approving writes.
Used for Looking up Filesystem data without leaving the editor
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Solid core, fiddly setup
I like it, with reservations. There is no auth layer, so whatever can reach it can use it. I keep it local only.
Used for Code review summaries for pull requests
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Promising, a bit raw
Mostly reliable, with the odd timeout. The past CVEs put me off at first. The fixed releases have been fine, just keep it updated. Keep permissions tight and it is a good tool.
Used for Debugging sessions in Cursor
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Struggled to get it stable
Ran into problems pretty quickly. There is no auth layer, so whatever can reach it can use it. I keep it local only. Runs locally over stdio, so startup is instant and nothing leaves my machine unless a tool calls out. Make sure you are on a patched version, there have been advisories against it.
Used for Letting a coding agent open and triage issues
- Setup & docs 1/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Does the job, docs could be better
Useful tool, though I would not hand it to a junior unsupervised. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list.
Used for Automating release notes
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Handy for dev, careful in prod
Works well enough for what I need. Updates land regularly, and nothing broke when I upgraded. There is no auth layer, so whatever can reach it can use it. I keep it local only. Fine in production if you sandbox it.
Used for Keeping project tickets in sync with code changes
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.