Is @modelcontextprotocol/server-filesystem safe?
2 fixed advisories Facts from the mcp-audit registry about the npm package @modelcontextprotocol/server-filesystem. The same data is served as JSON.
Check it from your terminal
mcp-audit vet @modelcontextprotocol/server-filesystemOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | Anthropic |
|---|---|
| Verified publisher | yes |
| Entry last checked | 2026-08-22 |
| Hash pins | yes; check them with mcp-audit scan --verify-hashes |
| Provenance expected | yes; a missing Sigstore attestation is reported (ATTEST-013) with --verify-signatures |
| Repository | https://github.com/modelcontextprotocol/servers |
Recorded advisories 2
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2025-53109 | not recorded | @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling | 2025.7.1 |
| CVE-2025-53110 | not recorded | @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix | 2025.7.1 |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
- It can read files on your machine.
- It can write or modify files on your machine.
Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit2 fixed CVEs
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/npm/at-modelcontextprotocol-server-filesystem/)