npm · server-filesystem2026.7.10

Evidence

],

  "scripts": {

    "build": "tsc && shx chmod +x dist/*.js",

    "prepare": "npm run build",

    "watch": "tsc --watch",

    "test": "vitest run --coverage"

  },

RemediationAI

The problem is that the `prepare` script runs `npm run build` automatically whenever the package is installed, executing arbitrary code on every developer's machine and in CI/CD pipelines without explicit user consent. Remove the `"prepare": "npm run build"` line from the scripts section in package.json and instead document that developers must manually run `npm run build` after cloning the repository or update CI/CD to explicitly call `npm run build` as a separate step. This eliminates the attack surface where a compromised dependency could execute malicious code during installation by removing the automatic hook execution. Verify the fix by running `npm install` in a clean environment and confirming that the dist/ directory is not automatically generated—it should only exist after explicitly running `npm run build`.

Evidence

# Filesystem MCP Server

Node.js server implementing Model Context Protocol (MCP) for filesystem operations.

Published on npm as [`@modelcontextprotocol/server-filesystem`](https://www.npmjs.com/package/@modelcontextprotocol/server-filesystem).

## Features

- Read/write files

- Create/list/delete directories

- Move files/directories

- Search files

- Get file metadata

- Dynamic directory access control via [Roots](https://modelcontextprotocol.io/docs/learn/client-concepts#roots)

## Directory A

RemediationAI

The problem is that the MCP manifest does not declare any authentication mechanism, making it unclear whether the filesystem server is protected and allowing reviewers to miss potential unauthorized access vulnerabilities. Add an explicit `auth` field to the MCP server configuration (typically in a manifest JSON or server initialization code) that documents the actual authentication method used—for example, `"auth": "none"` if it relies on host-level isolation, `"auth": "bearer"` if using tokens, or `"auth": "mtls"` if using mutual TLS. This fix makes the security posture explicit and auditable, allowing reviewers to verify that the authentication mechanism matches the deployment context and threat model. Verify the fix by reviewing the published MCP manifest schema, confirming the auth field is present and matches the actual server implementation, and documenting in the README.md which authentication layer (network, host, or application-level) protects the filesystem operations.