npm · server-filesystem2026.1.14

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic name that conflicts with MCP's reserved filesystem tool namespace, creating ambiguity and potential routing conflicts. Rename the tool to include a server-specific prefix such as 'myserver_write_file' or 'custom_write_file' in the tool.name property passed to server.tool() registration. This prefix ensures the tool name is globally unique within the MCP ecosystem and prevents shadowing of standard filesystem operations. Verify the fix by checking that the tool name in your MCP manifest or client logs shows the prefixed name and does not conflict with any reserved MCP tool names.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic name that conflicts with MCP's reserved filesystem tool namespace, creating ambiguity and potential routing conflicts. Rename the tool to include a server-specific prefix such as 'myserver_write_file' or 'custom_write_file' in the tool.name property passed to server.tool() registration. This prefix ensures the tool name is globally unique within the MCP ecosystem and prevents shadowing of standard filesystem operations. Verify the fix by checking that the tool name in your MCP manifest or client logs shows the prefixed name and does not conflict with any reserved MCP tool names.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic name that conflicts with MCP's reserved filesystem tool namespace, creating ambiguity and potential routing conflicts. Rename the tool to include a server-specific prefix such as 'myserver_write_file' or 'custom_write_file' in the tool.name property passed to server.tool() registration. This prefix ensures the tool name is globally unique within the MCP ecosystem and prevents shadowing of standard filesystem operations. Verify the fix by checking that the tool name in your MCP manifest or client logs shows the prefixed name and does not conflict with any reserved MCP tool names.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic name that conflicts with MCP's reserved filesystem tool namespace, creating ambiguity and potential routing conflicts. Rename the tool to include a server-specific prefix such as 'myserver_write_file' or 'custom_write_file' in the tool.name property passed to server.tool() registration. This prefix ensures the tool name is globally unique within the MCP ecosystem and prevents shadowing of standard filesystem operations. Verify the fix by checking that the tool name in your MCP manifest or client logs shows the prefixed name and does not conflict with any reserved MCP tool names.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

import fs from "fs/promises";

import { createReadStream } from "fs";

import path from "path";

import { z } from "zod";

import { minimatch } from "minimatch";

import { normalizePath, expandHome } from './path-utils.js';

import { getValidRoo

RemediationAI

The SearchFiles tool returns matching file contents verbatim to the LLM without delimiters, allowing an attacker to craft malicious file contents that inject prompt instructions into the LLM context. Wrap each matched file's content with clear provenance markers (e.g., `[FILE: path/to/file]\n{content}\n[END FILE]`) in the tool's response before returning to the client. These markers create a clear boundary between file data and LLM instructions, preventing injected content from being interpreted as system prompts. Test by creating files with prompt injection payloads in a searchable location and verify the markers prevent the LLM from executing the injected commands.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

import fs from "fs/promises";

import { createReadStream } from "fs";

import path from "path";

import { z } from "zod";

import { minimatch } from "minimatch";

import { normalizePath, expandHome } from './path-utils.js';

import { getValidRoo

RemediationAI

The SearchFiles tool returns matching file contents verbatim to the LLM without delimiters, allowing an attacker to craft malicious file contents that inject prompt instructions into the LLM context. Wrap each matched file's content with clear provenance markers (e.g., `[FILE: path/to/file]\n{content}\n[END FILE]`) in the tool's response before returning to the client. These markers create a clear boundary between file data and LLM instructions, preventing injected content from being interpreted as system prompts. Test by creating files with prompt injection payloads in a searchable location and verify the markers prevent the LLM from executing the injected commands.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

import fs from "fs/promises";

import { createReadStream } from "fs";

import path from "path";

import { z } from "zod";

import { minimatch } from "minimatch";

import { normalizePath, expandHome } from './path-utils.js';

import { getValidRoo

RemediationAI

The SearchFiles tool returns matching file contents verbatim to the LLM without delimiters, allowing an attacker to craft malicious file contents that inject prompt instructions into the LLM context. Wrap each matched file's content with clear provenance markers (e.g., `[FILE: path/to/file]\n{content}\n[END FILE]`) in the tool's response before returning to the client. These markers create a clear boundary between file data and LLM instructions, preventing injected content from being interpreted as system prompts. Test by creating files with prompt injection payloads in a searchable location and verify the markers prevent the LLM from executing the injected commands.

Evidence

],

  "scripts": {

    "build": "tsc && shx chmod +x dist/*.js",

    "prepare": "npm run build",

    "watch": "tsc --watch",

    "test": "vitest run --coverage"

  },

RemediationAI

The package.json declares a 'prepare' script that runs `npm run build` automatically during installation, executing arbitrary code on every developer's machine without explicit consent. Remove the 'prepare' hook from the scripts section or move the build step to a separate optional script (e.g., 'build-dist') that developers must invoke manually. This ensures that installing the package does not execute code, reducing supply-chain attack surface and giving developers control over when compilation occurs. Verify the fix by running `npm install` in a clean environment and confirming that TypeScript compilation does not occur automatically.

Evidence

# Filesystem MCP Server

Node.js server implementing Model Context Protocol (MCP) for filesystem operations.

## Features

- Read/write files

- Create/list/delete directories

- Move files/directories

- Search files

- Get file metadata

- Dynamic directory access control via [Roots](https://modelcontextprotocol.io/docs/learn/client-concepts#roots)

## Directory Access Control

The server uses a flexible directory access control system. Directories can be specified via command-line arguments or dyn

RemediationAI

The MCP manifest does not declare any authentication or authorization mechanism, making it unclear whether the server enforces access controls or relies on network-layer security. Add an explicit 'auth' or 'authorization' field to the server configuration (in package.json, README, or MCP manifest) documenting the actual security model—e.g., 'auth: "host-level"' if relying on OS permissions, or 'auth: "none"' if the server is intentionally unauthenticated. This transparency allows reviewers and users to understand the security posture and make informed decisions about deployment. Verify the fix by reviewing the manifest with a security team member to confirm the declared auth mechanism matches the actual implementation.