@cyanheads/filesystem-mcp-server

version tested 1.0.4npmtested 2026-10-13Sealmark 0.2.1methodology 0.3-draftSTANDARD run10 tools

Protocol4/4 points

Files1.5/4 pointscritical: fs-link-escape

Coverage: covered (5 of 10 tools reached with a valid call).

Protocol checks

Check	Verdict	What happened
protocol Valid MCP handshake and tool schemas	pass	handshake ok, 10 well-formed tool(s)
tool-poisoningcritical No tool-poisoning indicators in tool metadata	pass	scanned 10 tool definition(s), including parameter text: nothing suspicious (1 listing(s) failed and were not scanned)
robust-input Survives malformed tool input	pass	40 invalid call(s) rejected cleanly
secret-echocritical No environment secret echoed in responses	pass	canary secrets absent from tools/list and 40 captured response(s)

Files checks

Check	Verdict	What happened
fs-read-escapecritical Reads stay inside the allowed root	partial	15 path variants aimed outside the root were refused or returned nothing, on read_file, list_files, but set_filesystem_default (the control call on {sandbox}/ok.txt failed (Default path must be absolute.))
fs-write-escapecritical Writes stay inside the allowed root	pass	12 write attempts aimed outside the root left the canary directory and the sibling root unchanged
fs-link-escapecritical Links cannot lead out of the allowed root	fail	a link inside the root led to a file outside it: read_file via link-dir; read_file via link-file; list_files via link-dir; write_file write via link-dir-write
fs-size-cap Large file reads are capped	fail	read_file: the connection dropped or the call timed out (the response was too large for the transport)

What was not covered

Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
SQLite: Not applicable. No tool takes a SQL string
Effects: Not applicable. No tool declares annotations, so there is nothing to compare with what the sandbox observed
Tool "delete_file" was not covered by the fs pack: a delete tool is never called by the standard probes; add a custom probe to test it
Tool "delete_directory" was not covered by the fs pack: a delete tool is never called by the standard probes; add a custom probe to test it
Tool "set_filesystem_default" was not covered by the fs pack: the control call on {sandbox}/ok.txt failed (Default path must be absolute.)
Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
Tool "update_file" is covered by the core checks only: would be path (param "path", name matches /file/), but required parameter "blocks" cannot be filled by the harness; write a probes: entry to call it
Tool "move_path" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
Tool "copy_path" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
The sandbox is a convention the harness follows, not a security boundary. A malicious server runs with your user's privileges, sees the real file system and network, and can ignore cwd, HOME and PATH. Run untrusted servers in a throwaway VM or container.

Run it yourself

Started with the standard settings like this; put it in sealmark.yaml as the server:

npx -y @cyanheads/filesystem-mcp-server@1.0.4

Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.

Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.