MCP Reference Filesystem

Grade history

14 scans on record between 2026-06-20 and 2026-07-04. The grade has not changed across them.

History as recorded by this registry's own scans. The cause is an attribution from the inputs the registry records — the scanner engine identity and the declared tool surface — not proof of what changed on the server. Generated 2026-08-02.

How to read this grade

• What was scanned: @modelcontextprotocol/server-filesystem, as distributed.
• When: 2026-07-04 08:18:09.
• By what: mcpaudit 2.4.0, applied to the published danger rubric (weights, bands, and the critical cap are all public).
• What the grade means: this registry's opinion, computed by the disclosed automated methodology against the artifact version above, on the scan date above. It measures conformance to the rubric at scan time.
• What it does not claim: it is not a statement that the product is malicious, insecure in your deployment, or unfit for use, and it is not an endorsement or certification.
• Disagree? Grades are re-checkable against the same package version, and corrections are welcome: open a dispute — see the dispute & correction policy.

Spec-shift exposure

BREAKS against MCP 2026-07-28-rc · confidence medium · ruled 2026-07-18

What to change

• D1 [small] Drop the server.server.oninitialized assignment at dist/index.js:600 and establish roots without depending on handshake-time state - fetch them on first use, or accept them as tool parameters or server configuration. The surviving roots/list_changed handler at :587 already proves the non-handshake path works; it just needs an establishment entry point as well as a change entry point.

This is a point-in-time ruling against a release candidate, not the published specification, and it is independent of the danger grade above. Neither figure constrains the other.

Provenance & dispute

• Listing basis: operator-listed from a public catalog. This entry was not submitted by its vendor.
• Scan target: the published npm artifact @modelcontextprotocol/server-filesystem, installed and scanned locally using sandbox image mcp-trust-scan:corpus-2026-07-03. The public record stores the sandbox image, but not the network mode, so this page does not claim network isolation for that run.
• Credentials: none declared, none used.
• Dispute: vendor or maintainer of this server? Dispute this grade — first response within 14 days.

Findings

Score breakdown