Unreleased: not public yet. Maintainers have not reviewed this result.
Results / @modelcontextprotocol/server-filesystem
@modelcontextprotocol/server-filesystem
A
Protocol4/4 points
B
Files3/4 points
A
Effects2/2 points
Coverage: covered (13 of 14 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 14 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 14 tool definition(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 52 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 53 captured response(s) |
Files checks
| Check | Verdict | What happened |
|---|---|---|
| fs-read-escapecritical Reads stay inside the allowed root | pass | 89 path variants aimed outside the root were refused or returned nothing, on read_file, read_text_file, read_media_file, read_multiple_files, list_directory, list_directory_with_sizes, directory_tree, search_files, get_file_info |
| fs-write-escapecritical Writes stay inside the allowed root | pass | 30 write attempts aimed outside the root left the canary directory and the sibling root unchanged |
| fs-link-escapecritical Links cannot lead out of the allowed root | pass | 16 reads and writes through a symbolic link that points out of the root were refused |
| fs-size-cap Large file reads are capped | fail | read_file: the connection dropped or the call timed out (the response was too large for the transport); read_text_file: the connection dropped or the call timed out (the response was too large for the transport); read_media_file: the connection dropped or the call timed out (the response was too large for the transport); read_multiple_files: the connection dropped or the call timed out (the response was too large for the transport) |
Effects checks
| Check | Verdict | What happened |
|---|---|---|
| annotation-honestycritical Read-only tools change nothing | pass | read_file, read_text_file, read_media_file, read_multiple_files, list_directory, list_directory_with_sizes, directory_tree, search_files, get_file_info declared read-only and changed nothing in the observed directories during a benign call |
| openworld-honesty Closed-world tools stay on the machine | pass | 11 closed-world tool(s) called; nothing connected to the loopback listener (path and git tools cannot be pointed at it, so this confirms only that nothing connected out during the call) |
| undeclared-writes (advisory) Unannotated tools leave the sandbox unchanged | n/a | no unannotated read-style tool could be given a harness-owned control argument |
What was not covered
- Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
- SQLite: Not applicable. No tool takes a SQL string
- Tool "move_file" was not covered by the fs pack: link writes are probed through tools that take file content or create files
- Tool "(observer)" was not covered by the effects pack: writes outside the sandbox (the real home, a store named by an absolute path in server.env or args) are not observed
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "edit_file" is covered by the core checks only: would be path (param "path", name matches /file/), but required parameter "edits" cannot be filled by the harness; write a probes: entry to call it
- Tool "list_allowed_directories" is covered by the core checks only: the tool takes no parameters; add it under tools: to include it
- The sandbox is a convention the harness follows, not a security boundary. A malicious server runs with your user's privileges, sees the real file system and network, and can ignore cwd, HOME and PATH. Run untrusted servers in a throwaway VM or container.
- Prompt injection carried in tool output (only tool metadata is scanned)
- Authentication and transport security
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
npx -y @modelcontextprotocol/server-filesystem@1.0.0
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.