// SCAN REPORT

Filesystem

14 tools. 4 can modify or destroy data without limits.

4 write tools that can modify data. Rate limits recommended.

Last updated: 10 Jul 2026

4 can modify or destroy data

10 read-only

14 tools total

Verified publisher · catalogue entry checked 10/07/2026 · full schemas captured for 13 of 14 tools

How to control Filesystem ↓

TOOL MAP

What Filesystem exposes to your agents

Read (10) Write / Execute (4) Destructive / Financial (0)

Running more than one server? Check your whole stack →

CONTEXT-WINDOW COST

What Filesystem costs in tokens

1,666 tokens of tool definitions, loaded on every request

0.8% of a 200k context window

186 heaviest tool: read_text_file

Full per-tool breakdown → Model it in the token calculator →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Filesystem tools

Write · Low create_directory Creating directories is a write operation that modifies the filesystem by adding new structures. Write · High edit_file The tool creates or modifies file content reversibly through line-based edits, fitting the Write category. Write · High write_file The tool creates new files or modifies existing ones reversibly (files can be recovered or re-edited). Write · Medium move_file The tool modifies file paths and locations but does not delete or irreversibly destroy data.

4 of Filesystem's 14 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Filesystem

PolicyLayer is an MCP gateway — it sits between your AI agents and Filesystem, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "create_directory": {
    "limits": [
      {
        "counter": "create_directory_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "directory_tree": {
    "limits": [
      {
        "counter": "directory_tree_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Filesystem — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON FILESYSTEM →

Instant setup, no code required.

FULL CATALOGUE

All 14 Filesystem tools

WRITE 4 tools

Write create_directory Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. Write edit_file Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git- Write move_file Move or rename files and directories. Can move files between directories and rename them in a single operation Write write_file Create a new file or completely overwrite an existing file with new content. Use with caution as it will overw

READ 10 tools

Read directory_tree Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (fi Read get_file_info Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creati Read list_allowed_directories Returns the list of directories that this server is allowed to access. Subdirectories within these allowed dir Read list_directory Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between f Read list_directory_with_sizes Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly dist Read read_file Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead. Read read_media_file Read a file and return it as a base64-encoded content block with its MIME type. Image and audio files are retu Read read_multiple_files Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when Read read_text_file Read the complete contents of a file from the file system as text. Handles various text encodings and provides Read search_files Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns th

FAQ

Questions about Filesystem

How do I prevent bulk modifications through Filesystem? +

The Filesystem server has 4 write tools including create_directory, edit_file, move_file. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Filesystem.

How many tools does the Filesystem MCP server expose? +

14 tools across 2 categories: Read, Write. 10 are read-only. 4 can modify, create, or delete data.

How do I enforce a policy on Filesystem? +

Register the Filesystem MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Filesystem tool call.

Deterministic rules across all 14 Filesystem tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON FILESYSTEM →

Instant setup, no code required.

14 Filesystem tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Filesystem's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →