npm · server-filesystem2026.1.14

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic filesystem reserved name that conflicts with standard MCP filesystem server implementations, creating namespace collision and potential tool shadowing. Rename the tool to include a server-specific prefix such as 'custom_write_file' or 'myapp_write_file' in the tool registration call. This prefix ensures the tool name is globally unique and prevents accidental override of standard filesystem tools that clients may already depend on. Verify the fix by checking the MCP manifest or introspection output to confirm the new prefixed tool name appears and the old generic name is gone.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic filesystem reserved name that conflicts with standard MCP filesystem server implementations, creating namespace collision and potential tool shadowing. Rename the tool to include a server-specific prefix such as 'custom_write_file' or 'myapp_write_file' in the tool registration call. This prefix ensures the tool name is globally unique and prevents accidental override of standard filesystem tools that clients may already depend on. Verify the fix by checking the MCP manifest or introspection output to confirm the new prefixed tool name appears and the old generic name is gone.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic filesystem reserved name that conflicts with standard MCP filesystem server implementations, creating namespace collision and potential tool shadowing. Rename the tool to include a server-specific prefix such as 'custom_write_file' or 'myapp_write_file' in the tool registration call. This prefix ensures the tool name is globally unique and prevents accidental override of standard filesystem tools that clients may already depend on. Verify the fix by checking the MCP manifest or introspection output to confirm the new prefixed tool name appears and the old generic name is gone.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

RemediationAI

The tool 'write_file' uses a generic filesystem reserved name that conflicts with standard MCP filesystem server implementations, creating namespace collision and potential tool shadowing. Rename the tool to include a server-specific prefix such as 'custom_write_file' or 'myapp_write_file' in the tool registration call. This prefix ensures the tool name is globally unique and prevents accidental override of standard filesystem tools that clients may already depend on. Verify the fix by checking the MCP manifest or introspection output to confirm the new prefixed tool name appears and the old generic name is gone.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

import fs from "fs/promises";

import { createReadStream } from "fs";

import path from "path";

import { z } from "zod";

import { minimatch } from "minimatch";

import { normalizePath, expandHome } from './path-utils.js';

import { getValidRoo

RemediationAI

The SearchFiles tool returns matching file contents verbatim to the LLM without provenance delimiters, allowing an attacker to craft malicious file contents that inject prompt instructions directly into the LLM context. Wrap each matched file's content with clear provenance markers such as `[FILE: <path>]\n<content>\n[END FILE: <path>]` in the search results before returning to the client. These markers create a clear boundary between file data and LLM instructions, making prompt injection attempts visible and easier for the LLM to distinguish from legitimate instructions. Test by creating files with LLM instructions in their content, running a search, and verifying that the tool output clearly marks each result with file path and content delimiters.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

import fs from "fs/promises";

import { createReadStream } from "fs";

import path from "path";

import { z } from "zod";

import { minimatch } from "minimatch";

import { normalizePath, expandHome } from './path-utils.js';

import { getValidRoo

RemediationAI

The SearchFiles tool returns matching file contents verbatim to the LLM without provenance delimiters, allowing an attacker to craft malicious file contents that inject prompt instructions directly into the LLM context. Wrap each matched file's content with clear provenance markers such as `[FILE: <path>]\n<content>\n[END FILE: <path>]` in the search results before returning to the client. These markers create a clear boundary between file data and LLM instructions, making prompt injection attempts visible and easier for the LLM to distinguish from legitimate instructions. Test by creating files with LLM instructions in their content, running a search, and verifying that the tool output clearly marks each result with file path and content delimiters.

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { RootsListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";

import fs from "fs/promises";

import { createReadStream } from "fs";

import path from "path";

import { z } from "zod";

import { minimatch } from "minimatch";

import { normalizePath, expandHome } from './path-utils.js';

import { getValidRoo

RemediationAI

The SearchFiles tool returns matching file contents verbatim to the LLM without provenance delimiters, allowing an attacker to craft malicious file contents that inject prompt instructions directly into the LLM context. Wrap each matched file's content with clear provenance markers such as `[FILE: <path>]\n<content>\n[END FILE: <path>]` in the search results before returning to the client. These markers create a clear boundary between file data and LLM instructions, making prompt injection attempts visible and easier for the LLM to distinguish from legitimate instructions. Test by creating files with LLM instructions in their content, running a search, and verifying that the tool output clearly marks each result with file path and content delimiters.

Evidence

],

  "scripts": {

    "build": "tsc && shx chmod +x dist/*.js",

    "prepare": "npm run build",

    "watch": "tsc --watch",

    "test": "vitest run --coverage"

  },

RemediationAI

The package.json declares a 'prepare' npm lifecycle hook that runs `npm run build` automatically during installation, executing arbitrary code (TypeScript compilation and chmod) on every developer's machine and CI system without explicit consent. Remove the 'prepare' hook from the scripts section and instead document the build step in the README with instructions for developers to run `npm run build` manually before use, or move the build to a pre-commit hook using husky if build artifacts must be committed. Removing the install-time hook eliminates the attack surface where a compromised dependency could execute malicious code during installation and makes the build process transparent and auditable. Verify the fix by running `npm install` in a clean environment and confirming that dist/ files are not automatically generated; then manually run `npm run build` and confirm it works as expected.

Evidence

# Filesystem MCP Server

Node.js server implementing Model Context Protocol (MCP) for filesystem operations.

## Features

- Read/write files

- Create/list/delete directories

- Move files/directories

- Search files

- Get file metadata

- Dynamic directory access control via [Roots](https://modelcontextprotocol.io/docs/learn/client-concepts#roots)

## Directory Access Control

The server uses a flexible directory access control system. Directories can be specified via command-line arguments or dyn

RemediationAI

The MCP manifest and README do not declare any authentication or authorization mechanism, making it unclear whether the server relies on network-layer security (e.g., localhost-only, TLS mutual auth), host-level access control (e.g., file permissions), or no authentication at all. Add an explicit 'auth' or 'authorization' field to the manifest (or a dedicated section in README) documenting the security model, such as 'auth: "host-level file permissions"' or 'auth: "localhost-only, no authentication"' depending on the actual deployment model. Explicit documentation of the authentication model allows reviewers and operators to understand the security assumptions and make informed decisions about where and how to deploy the server. Verify the fix by reviewing the updated manifest or README with a security reviewer to confirm the declared auth mechanism matches the actual implementation and deployment constraints.