MCP Verdict
Back to the registry

mcp-server-filesystem (Snaggle AI)

MCP serverVerified · Rung 3
F40

The MCP filesystem server distributed by Snaggle AI as part of their commercial product offering. 14-tool implementation with directory allowlist enforcement. Distributed via the mcp-server-filesystem npm package.

RepositoryHomepageExample data

Score breakdown

Functional100/100
Reliability94/100
Latency100/100
Security38/100
Confidencelow · 50%

Based on 1 evaluation. Confidence rises as more independent tests agree.

Method rung1.v1computed Jul 14, 2026How we score

The verdict

14-tool filesystem server with directory allowlist. Direct path traversal, /etc/passwd reads, case-sensitivity bypass attempts, and writes outside the allowed directory are all blocked. However, re-verification reveals that read_file follows symlinks without resolving them against the allowlist. A symlink inside the allowed directory pointing to /etc/passwd returns its full contents when read_file is called on the symlink path — confirmed: 'root:x:0:0:root:/root:/bin/bash...' returned. Any agent with write access to the allowed directory can create a symlink and use it to read any file the process can access, bypassing the allowlist entirely. The server identifies itself as 'secure-filesystem-server v0.2.0' at the MCP protocol level, the same identity as the @adpharm read-only fork; both trace to the same mark3labs v0.2.0 ancestry.

This is a published failing verdict. We send the maintainer the full evaluation and a window to fix it or correct us before it goes live. Read the disclosure policy.

Security findings

Flags from our evaluations, ordered by severity.

  • High

    SYMLINK_FOLLOW_ESCAPE

    read_file follows symlinks inside the allowed directory without resolving them against the allowlist. A symlink at /tmp/fs_reverify_ws/symlink_to_etc_passwd pointing to /etc/passwd was created inside the allowed directory. Calling read_file on the symlink path returned the full contents of /etc/passwd: 'root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin...'. Any agent with write access to the allowed directory can create a symlink to any file the process can read and exfiltrate its contents.

  • Info

    SHARED_SERVER_IDENTITY

    Server reports name 'secure-filesystem-server' and version '0.2.0' at the MCP protocol level — the same identity as @adpharm/mcp-server-filesystem-ro. Both packages share the mark3labs v0.2.0 codebase. No security implication; noted so users are not confused when they see 'secure-filesystem-server v0.2.0' from what they installed as mcp-server-filesystem.

Test history

1 run

Every evaluation behind the score. This is the receipt.

  1. Passmanual
    Reliability

    94/100

    Latency

    2 ms

    Setup

    Easy

    Flags

    2

    14 tools verified via stdio NDJSON in a Node v22 sandbox (npm v0.6.2). Tools: read_file, read_multiple_files, write_file, edit_file, create_directory, list_directory, list_directory_with_sizes, directory_tree, move_file, search_files, get_file_info, list_allowed_directories. All return correct results. Case-sensitivity bypass attempt blocked. Path traversal blocked. /etc/passwd direct read blocked. Write outside allowed directory blocked.

    HighSYMLINK_FOLLOW_ESCAPEInfoSHARED_SERVER_IDENTITY

Notify me if this grade changes

We re-test servers and grades move. Leave your email and we will tell you if this one does.

mcp-server-filesystem (Snaggle AI) · MCP Verdict