Skip to main content
Glama

fsguard-mcp

PyPI

모든 작업을 허용된 디렉터리 트리 안으로 제한하는 filesystem + git MCP 서버입니다. 기준은 문자열 접두사 매칭이 아니라 심볼릭 링크를 해석하는 경로 포함(containment) 검증입니다.

왜 존재하는가

Anthropic의 공식 filesystem 및 git MCP 서버(@modelcontextprotocol/server-filesystem, modelcontextprotocol/servers의 일부, 89.7k★)는 10개월 동안 두 서버에 걸쳐 5건의 개별적인 경로 제한 CVE가 발생했으며, 그 패턴은 여전히 이어지고 있습니다:

  • CVE-2025-53109 / CVE-2025-53110 (filesystem, CVSS 8.4/7.3) — "허용 디렉터리" 검사가 단순한 startsWith() 접두사 매칭을 사용해서, 심볼릭 링크와 단순히 문자열 접두사만 공유하는 형제 디렉터리(예: 허용된 /home/user-safe이 /home/user-safe-evil에도 매칭)에 의해 우회되어, 파일시스템 전체 읽기/쓰기와 문서화된 RCE 경로를 허용했습니다.

  • CVE-2025-68143 / CVE-2025-68144 / CVE-2025-68145 (git) — git_init이 검증되지 않은 임의의 경로를 허용했고, git_diff/git_checkout가 사용자 제어 인자를 그대로 git CLI에 전달했으며(인자 주입), --repository 제한 모드는 repo_path이 제한된 디렉터리 안에 머무는지 실제로 확인하지 못했습니다.

  • CVE-2026-27735 (git, 이 프로젝트 시작 약 2개월 전에 공개됨) — GitPython의 repo.index.add()로 구현된 git_add가 ../ 형태의 경로에 대해 작업 트리(working tree) 경계를 강제하지 않아, 저장소 밖의 파일을 스테이징하고 빼돌릴 수 있었습니다.

  • 문서화된 RCE 체인: 쓰기 가능한 디렉터리에서 git_init → "clean" 필터가 있는 악성 .git/config → 그 필터를 적용하는 .gitattributes → git_add가 필터를 트리거 → 임의의 셸 명령 실행.

이 모든 CVE들은 특정 함수 하나에 문자열/접두사 검사를 하나 더 덧붙이는 방식으로 패치되었습니다. 아무도 이런 경계 강제를 새 도구가 쉽게 빠뜨릴 수 없는 공통 지점으로 옮기지 않았습니다. 그런 결과로 세 번째 CVE가 처음 세 개를 "수정"된 지 정확히 4개월 뒤에 나타났습니다.

Related MCP server: Secure Local Workspace MCP

fsguard-mcp가 다른 점

  1. 모든 곳에서 쓰는 하나의 안전 프리미티브. filesystem이든 git이든 모든 도구는 어떤 작업을 하기 전에 먼저 동일한 ConfinedRoot(confined_path.py 참고)를 통해 대상 경로를 해석합니다. 잊어버릴 수 있는 도구별 경로 검사가 존재하지 않습니다.

  2. 심볼릭 링크 해석 기반, 경로 구성 요소(component) 단위의 containment — 문자열 매칭이 아님. 어떤 경로가 루트 안에 있는지는, 그 경로의 완전히 해석된 실제 경로(모든 심볼릭 링크를 따라간)가 루트 자체의 해석된 실제 경로에 대해 실제로 조상-후손 관계인 하위 경로인 case에만 참입니다. 이 판정은 해석된 경로에 대한 Path.is_relative_to()으로만 수행하며, 문자열에 대한 startsWith()은 절대 사용하지 않습니다. 이 사실만으로 CVE-2025-53109/53110의 정확한 실패 사례가 차단됩니다: 해석된 루트 /allowed에 대해 /allowed-evil은 포함 검사를 통과할 수 없습니다. 경로 구성 요소 비교는 문자열 접두사 비교가 아니기 때문입니다.

  3. 콘텐츠를 위해 git으로 셸을 띄우는 일은 절대 없습니다. git 작업은 dulwich에서 수행됩니다. dulwich은 순수 Python git 구현이라 콘텐츠 관련 작업에 subprocess가 없고 사용자 입력으로 argv를 만들지도 않으며, 특히 clean/smudge 필터를 실행하지 않습니다. 문서화된 RCE 체인이 의존하는 것이 바로 그 기능입니다. 여기에는 인자 주입 표면이 없습니다. 파일 콘텐츠를 읽고 쓰기 위해 외부 프로세스에 건넬 인자 목록 자체가 없기 때문입니다. (단, dulwich은 훅이 존재하면 pre-commit/commit-msg/post-commit을 subprocess.call()로 실제 실행하기는 합니다 — 실제 프로세스 실행이지만 콘텐츠 필터링과는 무관합니다. git_commit은 항상 no_verify=True를 전달해 이들을 일단 무시하므로, 그 훅이 실행되지 않기를 우연에 맡기지 않습니다.)

  4. 쓰기 작업은 기존 대상뿐만 아니라 부모 디렉터리도 함께 검증합니다. 이로써 대상이 아직 존재하지 않아서(따라서 "이 경로가 루트 안에 해석되는가"를 존재하지 않는 경로로 확인할 수 없어 심볼릭 해석을 못 하는 케이스) 생기는 버그 계열을 막습니다. 특히 부모 디렉터리 자체가 외부를 가리키는 심볼릭 링크인 경우를 닫습니다. 존재하지 않는 경로 세그먼트는 디스크 상태와 무관하게 어휘 수준에서 ./..를 순수 경로 대수로 정리합니다. 이 모든 것 전에 실행합니다. 이 프로젝트의 초기 버전에서는 정규화를 검사 후에 해만, 결과적으로 테스트가 Windows(경로 API가 ..를 자동으로 정리해줌)에서 전부 통과했지만 Linux/macOS에서 우회 가능 상태였습니다. 지금은 해당 정확한 케이스를 테스트로 고정해두었고요. 다만 그 덕분에 이 프로젝트는 "내 머신에서는 테스트가 초록색"이라는 말에 진지한 의심을 품게 됐습니다.

  5. .git/config로 루트 밖으로 작업을 우회할 수 없습니다. dulwich은 저장소 자체의 core.worktree 설정을 있는대로 따르고, 모든 git 작업이 내부적으로 경로 문자열에서 Repo를 다시 여니까, 호출자가 악성으로 .git/config의 core.worktree을 어디에든 가리키게 쓰면, 이후의 git 도구 모두가 제한 루트 밖에서 조용히 작동하게 됩니다. 그리고 경로별 검사(제한된 저장소 디렉터리만 볼 뿐, dulwich이 실제로 자기 자신을 어디로 우회했는지는 볼 수 없음)로 잡혀지지 않습니다. 이번 버그는 첫 커밋 전 두 번째 보안 검토에서 실제 발견됐습니다 — 이 서버가 노출하는 도구만으로 저장소 밖 파일을 읽고 빼돌릴 수 있는, 이서버가 고치려던 어떤 CVE보다 심각한 일이었습니다. 이제 모든 git 도구는 core.worktree 설정이 있는 저장소를 성단 열기를 거부하고, 열었던 Repo 객체가 실제 보고하는 작업 경로가 검증했던 정확한 디렉터리인지도 다시 확인합니다.

  6. UNC 경로와 크로스 드라이브 경로는 네트워크/디스크에 닿기 전에 거부됩니다. \\host\share\... 경로를 해석하면 Windows가 실제로 SMB 연결을 시도합니다. 그리고 그 연결을 서버 프로세스의 자격으로 인증하려 하기 때문에 "UNC 경로를 통한 강제(forced) NTLM auth" 자격 증명 탈취가 발생합니다. 게다가 연결이 불가능한 호스트를 만나면 서버가 전체 커넥션 타임아웃 동안 블로킹됩니다. 허용된 루트와 드라이버, 호스트가 다른 경로는 발생 어떠한 파일시스템/네트워크 작업에 앞서 저렴한 문자열 비교만으로 기각됩니다. NTFS Alternate Data Streams(file.txt:hidden) 역시 원천 차단합니다. 이런 경로는 디렉터리 목록에는 보이지 않지만 동일한 경로 문자열로 충분히 읽기/쓰기가 가능하며, Windows의 다운로드 주의 경고인 "Mark of the Web"이 없는 것처럼 감출 수 있습니다.

Tools

Tools

역할

fs_read(path)

텍스트 파일 읽기

fs_write(path, content)

텍스트 파일 만들기 또는 덮어쓰기

fs_list(path=".")

디렉터리 항목 나열

fs_search(pattern, path=".")

글로브(glob) 일치 파일을 재귀 검색

fs_move(source, destination)

파일 이동/이름 변경

git_init_repo(repo_path)

git 저장소 초기화

git_repo_status(repo_path=".")

스테이지/스테이지되지 않음/추적되지 않음 파일 표시

git_stage(repo_path, paths)

파일을 스테이지

git_commit_repo(repo_path, message, author)

스테이지된 변경사항 커밋

git_diff_repo(repo_path=".", staged=False)

diff 표시

git_log_repo(repo_path=".", max_entries=10)

커밋 이력 표시

Setup

pip install fsguard-mcp
export FSGUARD_ROOT="/path/to/the/one/directory/tree/this/server/may/touch"
fsguard-mcp

FSGUARD_ROOT는 필수입니다. 기본값은 없고, 서버는 하나를 추측하지 않습니다. MCP 클라이언트 설정에서 FSGUARD_ROOT를 지정한 fsguard-mcp 명령어를 가리켜세요.

Testing

pip install -e ".[dev]"
pytest tests/ -v

모든 68개 테스트는 자체적으로 완결되어 있습니다(실제 임시 디렉터리, 실제 심볼릭 링크, 실제 git 저장소가 사용됩니다). 외부 서비스는 필요하지 않습니다.

알려진 제한

포함(containment) 검사를 하고 나서 파일시스템 작업이 수행되는 과정에서, 그 사이에는 내재적으로 TOCTOU(시간-검사-시간-사용, time-of-check-to-time-of-use) 공백이 발생합니다. 제한된 루트의 내부 트리에 대해 쓰기 권한을 가지고 있는 다른 프로세스가 원리를 그 창에 심볼릭 링크를 교체할 수 있습니다(설계 검토 중 실제 동작하는 PoC로 검증한 사항). 완전히 봉인하려면 POSIX 파일시스템 레벨의 프리미티브(리눅스의 openat2(RESOLVE_BENEATH), 혹은 실행되는 mount namespace 자체)가 필요하며, 휴대용(portable) Python으로 해결할 수 있는 범위가 아닙니다. 이 프로젝트가 제공하는 보장은 "사용 직전 시점에 확인하는 올바른 포함 제어 로직"이지, "루트 내부 이미 존재하는 동시성 추구자에게 면역"은 아닙니다.

상태

v0.1.0, PyPI에서 라이브. 테스트 68개 이름(실제 파일시스템에 실제 심볼릭 링크, 실제 git repo 있음. 단순 문자열 논리 검증이 아니라 유닛). 첫 커밋 근처 기준으로 두 차례의 컨테이너 보안 검토를 거쳤고, 두 차례에서 모두 실제로 유효였 던 우회를 찾았습니다(POSIX에서 존재하지 않는 경로 사용한 .. 이동 탈출과 위에서 설명한 core.worktree 재지정, 기타 소소한 발견). 그것들은 현재 수정하여, 발견된 발현형 그대로 씨된 테스트로 보호되며, 새 설치된 pip install에서 배포된 패키지로 재검증했습니다.

License

MIT

Available Tools

11 tools
fs_listA

List the entries of a directory, each tagged file or directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does reveal that entries are tagged by type, which is useful, but it omits details such as whether hidden files are included, whether the listing is recursive, or any read-only guarantee. For a simple list operation this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that conveys the core action and output format without any fluff. It is front-loaded and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no complex schema, no output schema), the description covers the essential behavior and output type. It does not explain error handling or edge cases, but for a listing operation this is sufficient. The lack of annotations and output schema raises the bar, yet the description still provides enough for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not elaborate on the 'path' parameter beyond its presence in the schema. However, the parameter is self-explanatory and has a default, so the lack of extra explanation is not a major gap. The description adds no semantic detail but the situation is simple enough that this is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'entries of a directory', and specifies that each entry is tagged as file or directory. This distinguishes it unambiguously from siblings like fs_read (read file content), fs_write, and fs_search, making the tool's purpose immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. It does not mention scenarios where it is preferred (e.g., exploring a directory before reading a file) or when a different tool like fs_search would be more appropriate. The description lacks any routing or exclusionary context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs_moveA

Move or rename a file/directory. Both source and destination must resolve within FSGUARD_ROOT. If destination already exists as a file, it is overwritten. If destination already exists as a directory, the call fails instead of moving source inside it.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYes
destinationYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It covers key behaviors: the FSGUARD_ROOT constraint, overwriting behavior for existing destination files, and failure on existing destination directories. These are critical edge cases. It doesn't mention permissions, reversibility, or what happens if the source doesn't exist, but the provided details adequately outline the operation's behavior for typical use.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the purpose, and includes all necessary behavioral constraints without redundancy. Every sentence adds value—there is no filler or repetition. This is exemplary conciseness for a tool definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (move/rename with edge cases), the schema has no descriptions, no output schema, and no annotations, the description covers the essential aspects: the root constraint, overwrite behavior, and directory failure. It omits minor details like behavior when source is missing or return value expectations, but the absence of an output schema reduces the need to describe returns. Overall, it is adequately complete for an agent to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no per-parameter descriptions), so the description must compensate. It adds meaning by explaining both parameters must resolve within FSGUARD_ROOT and describes destination behavior. However, it does not explicitly define source as the current path and destination as the target path, nor does it specify path format (absolute vs relative). The added semantics are helpful but not fully comprehensive for a 0% coverage case.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb+resource combination: 'Move or rename a file/directory.' This immediately distinguishes it from siblings like fs_read, fs_write, fs_list, and fs_search, which cover other file operations. No ambiguity remains about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool (moving/renaming within FSGUARD_ROOT) and includes specific edge-case behaviors (overwrite on existing file, failure on existing directory). However, it does not explicitly mention alternatives or when not to use it, which would push it to a 5. The guidance is sufficient for an agent to decide this is the right operation among file tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs_readA

Read a text file's contents. path is relative to FSGUARD_ROOT.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. It correctly implies a read-only operation (no side effects) and adds the key detail that paths are relative to FSGUARD_ROOT. However, it does not disclose error handling, file encoding, or limitation to text files only, which are relevant for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two short sentences with no unnecessary words. The critical scoping detail (path relative to FSGUARD_ROOT) is front-loaded in the second sentence, ensuring the agent reads it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read operation with one parameter and no output schema, the description is largely sufficient: it states the tool's function and the key path constraint. Minor gaps (such as return format and error behavior) are not critical given the simplicity, but a bit more detail could improve completeness relative to an agent's expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so by explaining the crucial semantic of the path parameter: relative to FSGUARD_ROOT. This adds significant meaning beyond the bare schema, though it does not cover other potential constraints like allowed file types or size limits.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'read' and the resource 'text file contents', making the tool's purpose unambiguous. It also specifies that the path is relative to FSGUARD_ROOT, which differentiates it from sibling tools like fs_write, fs_list, fs_search, and fs_move.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (reading file contents) but does not explicitly mention when to avoid this tool or provide alternatives. Unlike get_calls which names a sibling, here the sibling tool names are enough to infer differentiation, but no formal guidance is given. The intended context is clear from the verb 'read'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs_writeA

Write (creating or overwriting) a text file. Parent directories are created as needed, but only within FSGUARD_ROOT.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
contentYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals that the operation overwrites existing content, creates parent directories as needed, and is restricted to FSGUARD_ROOT. This covers key side effects and constraints. It does not mention permissions, failure modes, or atomicity, but for a simple write operation the core behaviors are well disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no unnecessary words. It front-loads the primary action and immediately follows with important behavioral details. Every word adds value, making it an exemplar of efficient writing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter write tool, the description covers the essential behavior: creating/overwriting, parent directory creation, and the root restriction. It lacks details like return values or error handling, but those are not critical for an agent to invoke the tool correctly. Given the tool's simplicity, the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It clarifies that 'content' is text and 'path' can include nested directories (since parents are created) and must be within FSGUARD_ROOT. However, it does not explicitly define the format of 'path' (relative vs absolute) or provide examples. It adds some semantic value but is not fully explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Write'), the resource ('a text file'), and the behavior ('creating or overwriting'). It also notes the automatic creation of parent directories, which distinguishes it from a simple write. The sibling tools (read, list, search, move) are clearly distinct, so purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (for writing files), but does not explicitly state when not to use it or point to alternatives. There is no mention of exclusions or conditions, such as 'use fs_move to relocate files' or 'use fs_append for non-overwriting writes.' The intended usage is inferred from the verb and siblings, but not explicitly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_commit_repoC

Commit staged changes. author must be 'Name '.

ParametersJSON Schema
NameRequiredDescriptionDefault
authorYes
messageYes
repo_pathYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the core action (commit) but omits side effects, such as whether it modifies the repository history, requires prior configuration (user.name/email), or how it handles empty commits. The author format hint is the only extra detail, which is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief, which is structurally good, but it sacrifices substance for brevity. It uses two short sentences and front-loads the purpose, but the content is so thin that it fails to earn its place as a useful guide. It is under-specified rather than efficient, so a 3 is appropriate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is a mutating Git operation with no output schema and no annotations, the description should cover prerequisites (e.g., staged changes, existing repo, user config). It mentions 'staged changes' but omits what the commit will look like, error cases, and any required prior state. The description is incomplete for a tool in this context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must clarify parameters, but it does not. Only the 'author' parameter is given a format hint ('Name <email>'), while 'repo_path' and 'message' are left entirely to the schema's title-only definitions. The description adds almost no value for parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action ('Commit staged changes') with a specific resource (the repository). It distinguishes itself from siblings like git_stage, git_diff_repo, and git_log_repo by focusing on committing, which is a distinct operation. No ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by mentioning 'staged changes', suggesting it should be used after git_stage, but it does not explicitly state when to use this tool versus alternatives, nor does it mention any prerequisites or competing tools. The guideline is only implicit from the word 'staged'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_diff_repoC

Show the diff for a repo's working tree (or staged changes).

ParametersJSON Schema
NameRequiredDescriptionDefault
stagedNo
repo_pathNo.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavior. It doesn't state whether the operation is read-only, whether it modifies state, or what output to expect. It only says 'show the diff', leaving ambiguity about side effects and edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with zero wasted words. It states the action first and conveys the key distinction efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite being a simple tool, the description is incomplete: it doesn't specify the default behavior (staged=false means working tree), explain `repo_path`, or clarify that this is a read-only operation. With no annotations and low schema coverage, more context is needed for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the `staged` distinction ('working tree or staged changes'), which adds meaning beyond the schema. However, it fails to mention `repo_path` at all, leaving its semantics unexplained. With 0% schema coverage, this partial compensation is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it 'Shows the diff for a repo's working tree (or staged changes)', using a specific verb and resource. It distinguishes from sibling tools like git_repo_status (status) and git_log_repo (history), though it doesn't name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. It doesn't mention exclusions, prerequisites, or situations where another sibling would be more appropriate. An agent must infer usage from the description alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_init_repoA

Initialize a new git repository at repo_path (relative to FSGUARD_ROOT).

ParametersJSON Schema
NameRequiredDescriptionDefault
repo_pathYes

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden. It discloses that the tool mutates the filesystem by initializing a repository, but it does not mention side effects such as behavior when the path already exists, permissions needed, or failure modes. This is minimal beyond the obvious action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that immediately states the action and the key parameter nuance. There is zero redundancy, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description covers the essential details: what it does and the path base. It could benefit from a note about idempotency or failure but is largely complete given its low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides no description for repo_path (0% coverage). The tool description compensates by clarifying that the path is relative to FSGUARD_ROOT, which is essential context. However, it does not elaborate on path format, existence requirements, or other constraints, so it only partially compensates for the lacking schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb ('Initialize') and a specific resource ('a new git repository at repo_path'), and adds the crucial context that the path is relative to FSGUARD_ROOT. This effectively distinguishes it from sibling git tools like git_repo_status or git_stage, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or exclusions are provided. The tool's name and description imply that it is for initializing a repository, while siblings handle other operations, but this is left to inference rather than stated clearly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_log_repoC

Show recent commit history.

ParametersJSON Schema
NameRequiredDescriptionDefault
repo_pathNo.
max_entriesNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must bear full responsibility for behavioral disclosure. It merely says 'Show', which implies a read-only operation, but it does not explicitly state that it is non-destructive, nor does it mention requirements like a valid Git repository, potential side effects, or any limitations on what 'recent' means.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely brief, which might be considered efficient, but it omits essential details. It is under-specified rather than appropriately concise—there is no front-loading of critical constraints, and the single sentence provides minimal value beyond the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool, a one-line description could be sufficient in a richer context, but here the schema and annotations are empty, and no output schema exists. The description fails to cover parameter semantics, expected behavior, or output format, leaving the agent with too little information to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (no descriptions in the input schema) and the description does not mention either parameter (repo_path or max_entries). The agent receives no guidance on what these parameters mean, their default values, or how they affect the output. The description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Show recent commit history.' This clearly conveys the tool's intent and is not a tautology. It does not explicitly differentiate from sibling tools like git_repo_status or git_diff_repo, but the resource is distinct enough for a capable agent to infer the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as git_repo_status or git_diff_repo. There is no mention of exclusions, prerequisites, or scenarios where this tool is preferred. The agent is left without contextual cues beyond the basic title.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_repo_statusB

Show staged, unstaged, and untracked files for a repo.

ParametersJSON Schema
NameRequiredDescriptionDefault
repo_pathNo.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the burden of behavioral disclosure. It only says 'show', implying read-only, but does not explicitly state non-mutation, no side effects, or any constraints like requiring a valid git repository or permissions. No additional behavioral traits are revealed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with zero waste. It directly states the tool's output scope without filler. Every word contributes to understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple status tool, this is adequate but not complete. It tells what it shows but does not describe the return format, error behavior, or how repo_path is used (e.g., defaults to current directory). With no output schema, the agent lacks information about what to expect from the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does not mention the repo_path parameter at all, nor its default behavior. While repo_path is self-explanatory from the name, the description adds no meaning beyond the schema, failing to compensate for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool shows staged, unstaged, and untracked files for a repo. This is specific and distinguishes it from siblings like git_diff_repo (differences) and git_log_repo (history). The verb 'show' and resource 'files' are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No mention of when to use this tool versus alternatives. There is no guidance on when to prefer this over other git tools (e.g., git_diff_repo, git_stage) or any prerequisites like 'only use on a valid repo'. The description does not provide context for exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_stageA

Stage files for commit. Every path is validated against FSGUARD_ROOT before being staged — a path that would escape the root fails the whole call, staging nothing.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathsYes
repo_pathYes

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does this exceptionally well by revealing two critical behaviors: (1) every path is validated against FSGUARD_ROOT, and (2) a path escaping the root causes the entire call to fail, staging nothing. This goes far beyond what the schema provides and directly affects how an agent should reason about success/failure and safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that leads with the core purpose ('Stage files for commit') and immediately follows with the crucial safety behavior. There is zero filler, and the most important operational detail (path validation) is front-loaded. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters, no output schema, and no annotations, the description covers the purpose and a key safety behavior but omits essential operational details. It does not state what a successful staging returns, whether the repo_path must already be initialized (though sibling git_init_repo implies it may be), or how paths are interpreted (relative to repo_path?). While the safety note is valuable, the description leaves an agent guessing on parameter semantics and success indicators, so it is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage for its two parameters (repo_path and paths). The description does not explicitly explain these parameters beyond implying that 'paths' are files to stage and 'repo_path' is the repository location. It fails to clarify format (e.g., absolute vs relative paths), whether paths are relative to repo_path, or any constraints on repo_path. Given the low coverage, the description should have compensated with parameter details, but it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Stage files for commit.' This is a specific verb ('stage') with a clear resource ('files for commit'), which distinguishes it from sibling Git tools like git_init_repo, git_repo_status, git_commit_repo, git_diff_repo, and git_log_repo. No ambiguity about what it does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context: you stage files before committing. It does not explicitly mention when not to use it or alternative tools (e.g., 'use git_commit_repo to commit the staged files'), but the purpose is clear enough that an agent could infer its place in the workflow. It also highlights a critical constraint (path validation against FSGUARD_ROOT) that acts as guidance for safe usage, though it does not name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.0
    • First observedfs_list
    • First observedfs_move
    • First observedfs_read
    • First observedfs_search
    • First observedfs_write
    • First observedgit_commit_repo
    • First observedgit_diff_repo
    • First observedgit_init_repo
    • First observedgit_log_repo
    • First observedgit_repo_status
    • First observedgit_stage

TDQS

A3.5/5.0

Scored across 11 tools

Disambiguation5/5

Each tool targets a distinct operation: file read, write, list, search, move; git init, status, stage, commit, diff, log. There is no overlap or ambiguity between tools, enabling reliable selection.

Naming Consistency4/5

The naming follows a consistent fs_/git_ prefix pattern with action-oriented verbs. Minor deviation like 'git_repo_status' vs 'git_stage' (noun-verb vs verb-only) creates slight inconsistency but remains predictable.

Tool Count5/5

11 tools cover file system and git operations without redundancy. The scope is well-balanced—enough to handle common workflows without overwhelming the agent.

Completeness3/5

The file system layer includes create, read, update, list, search, and move, but lacks a delete operation, which is a notable gap. Git coverage is solid for basic workflows but omits branch operations. Overall, a reasonable surface for the intended guarded-root use case.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Exposes a secure, path-confined bridge to a local workspace and git remotes, enabling MCP clients to search, read, write, reset files, and perform git operations.
    -
  • A
    license
    A
    quality
    B
    maintenance
    Enables ChatGPT and Codex to safely work with explicitly authorized local project folders through MCP, providing constrained file reading, searching, patch editing, Git inspection, and whitelisted tasks without exposing arbitrary shell, deletion, or deployment capabilities.
    17
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables ChatGPT or any MCP client to operate safely on a designated workspace by listing, reading, searching, writing, and trashing files, inspecting Git status/log/diff, and optionally running allowlisted executables without a shell.
    Apache 2.0