// SCAN REPORT

FilesystemMCP

34 tools. 17 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 3 Jul 2026

17 can modify or destroy data

17 read-only

34 tools total

Community server · catalogue entry verified 03/07/2026

How to control FilesystemMCP ↓

TOOL MAP

What FilesystemMCP exposes to your agents

Read (17) Write / Execute (15) Destructive / Financial (2)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous FilesystemMCP tools

Destructive · High delete_file This tool irreversibly removes files with no recovery mechanism. Destructive · High delete_lines This tool permanently removes data from files without the ability to undo the operation. Write · High replace_js_imports This tool creates or modifies file content (the imports section) reversibly. Write · Medium add_js_import This is a Write operation: it creates or modifies file content (JavaScript imports) in a reversible manner.

17 of FilesystemMCP's 34 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control FilesystemMCP

PolicyLayer is an MCP gateway — it sits between your AI agents and FilesystemMCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_file": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_js_import": {
    "limits": [
      {
        "counter": "add_js_import_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "directory_tree": {
    "limits": [
      {
        "counter": "directory_tree_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register FilesystemMCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON FILESYSTEMMCP →

Instant setup, no code required.

FULL CATALOGUE

All 34 FilesystemMCP tools

DESTRUCTIVE 2 tools

Destructive delete_file Permanently delete a file. Will not delete directories. Use with caution as this operation cannot be undone. O Destructive delete_lines Delete a range of lines from a file by line number. Only works within allowed directories.

WRITE 15 tools

Write add_js_import Append a single import (or require) statement after the last existing import in a JavaScript file. Idempotent Write append_to_file Append content to the end of an existing file without reading or rewriting it. Much more efficient than write_ Write copy_file Copy a file from source to destination without passing content through the agent. If the destination file alre Write copy_lines Copy a range of lines and insert the copy after a given line number. Original lines are preserved. Use with mo Write copy_lines_between_files Copy a range of lines from one file and insert the copy into a different file after a given line number. Origi Write create_directory Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. Write edit_file Make line-based edits to a text file. Each edit replaces a line range with new content (which may span any num Write insert_lines Insert new content after a specific line number. Use line 0 to insert at the beginning of the file. Only works Write move_file Move or rename files and directories. Can move files between directories and rename them in a single operation Write move_lines Move a range of lines to after a given line number (cut and paste). Line numbers are adjusted automatically fo Write move_lines_between_files Move (cut and paste) a range of lines from one file into a different file after a given line number. The lines Write replace_js_function Replace a named function or class in a JavaScript file by name. Finds the full function body automatically — n Write replace_js_imports Replace the entire imports block of a JavaScript file. Use get_js_imports first to see the current imports. ne Write replace_lines Replace a range of lines in a file by line number. More token-efficient than edit_file when you already know t Write write_file Create a new file with the given content. NEVER overwrites an existing file — if the path already exists, the

READ 17 tools

Read directory_tree Get a recursive tree view of files and directories as a JSON structure. Each entry includes Read file_stats Return quick metadata about a file: size, total line count, last modified time, and a 5-line preview. Use this Read find_in_file Search for a phrase within a single file. Handles phrases split across lines (e.g. at 80-char wrap) by matchin Read find_in_files Search for a phrase inside file contents recursively under a directory. Handles phrases split across lines (e. Read get_file_info Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creati Read get_js_function Extract a named function or class from a JavaScript file by name, returning its full source and line range. Us Read get_js_imports Extract all import and require statements from a JavaScript file, with line numbers. Use this to inspect depen Read list_allowed_directories Returns the list of directories that this server is allowed to access. Subdirectories within these allowed dir Read list_directory Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between f Read list_directory_with_sizes Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly dist Read list_js_functions List all function and class definitions in a JavaScript file, with their start and end line numbers. Use this Read read_file Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead. Read read_lines Read a specific range of lines from a file by line number. Use find_in_file first to locate keywords and get t Read read_media_file Read an image or audio file. Returns the base64 encoded data and MIME type. Only works within allowed director Read read_multiple_files Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when Read read_text_file Read the complete contents of a file from the file system as text. Handles various text encodings and provides Read search_files Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns th

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about FilesystemMCP

Can an AI agent delete data through the Filesystem MCP server? +

Yes. The FilesystemMCP server exposes 2 destructive tools including delete_file, delete_lines. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through FilesystemMCP? +

The FilesystemMCP server has 15 write tools including add_js_import, append_to_file, copy_file. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach FilesystemMCP.

How many tools does the Filesystem MCP server expose? +

34 tools across 3 categories: Destructive, Read, Write. 17 are read-only. 17 can modify, create, or delete data.

How do I enforce a policy on FilesystemMCP? +

Register the Filesystem MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every FilesystemMCP tool call.

Deterministic rules across all 34 FilesystemMCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON FILESYSTEMMCP →

Instant setup, no code required.

34 FilesystemMCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.