mcp-server-filesystem (Snaggle AI)
MCP serverVerified · Rung 3The MCP filesystem server distributed by Snaggle AI as part of their commercial product offering. 14-tool implementation with directory allowlist enforcement. Distributed via the mcp-server-filesystem npm package.
Security cap applied
Score breakdown
Based on 1 evaluation. Confidence rises as more independent tests agree.
The verdict
14-tool filesystem server with directory allowlist. Direct path traversal, /etc/passwd reads, case-sensitivity bypass attempts, and writes outside the allowed directory are all blocked. However, re-verification reveals that read_file follows symlinks without resolving them against the allowlist. A symlink inside the allowed directory pointing to /etc/passwd returns its full contents when read_file is called on the symlink path — confirmed: 'root:x:0:0:root:/root:/bin/bash...' returned. Any agent with write access to the allowed directory can create a symlink and use it to read any file the process can access, bypassing the allowlist entirely. The server identifies itself as 'secure-filesystem-server v0.2.0' at the MCP protocol level, the same identity as the @adpharm read-only fork; both trace to the same mark3labs v0.2.0 ancestry.
This is a published failing verdict. We send the maintainer the full evaluation and a window to fix it or correct us before it goes live. Read the disclosure policy.
Security findings
Flags from our evaluations, ordered by severity.
- High
SYMLINK_FOLLOW_ESCAPE
read_file follows symlinks inside the allowed directory without resolving them against the allowlist. A symlink at /tmp/fs_reverify_ws/symlink_to_etc_passwd pointing to /etc/passwd was created inside the allowed directory. Calling read_file on the symlink path returned the full contents of /etc/passwd: 'root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin...'. Any agent with write access to the allowed directory can create a symlink to any file the process can read and exfiltrate its contents.
- Info
SHARED_SERVER_IDENTITY
Server reports name 'secure-filesystem-server' and version '0.2.0' at the MCP protocol level — the same identity as @adpharm/mcp-server-filesystem-ro. Both packages share the mark3labs v0.2.0 codebase. No security implication; noted so users are not confused when they see 'secure-filesystem-server v0.2.0' from what they installed as mcp-server-filesystem.
Test history
1 runEvery evaluation behind the score. This is the receipt.
- PassmanualReliability
94/100
Latency2 ms
SetupEasy
Flags2
14 tools verified via stdio NDJSON in a Node v22 sandbox (npm v0.6.2). Tools: read_file, read_multiple_files, write_file, edit_file, create_directory, list_directory, list_directory_with_sizes, directory_tree, move_file, search_files, get_file_info, list_allowed_directories. All return correct results. Case-sensitivity bypass attempt blocked. Path traversal blocked. /etc/passwd direct read blocked. Write outside allowed directory blocked.
HighSYMLINK_FOLLOW_ESCAPEInfoSHARED_SERVER_IDENTITY
Notify me if this grade changes
We re-test servers and grades move. Leave your email and we will tell you if this one does.