file-bridge
One-line summary: File Bridge exposes six stdio-only, folder-scoped file tools (read, list, search, glob, write, patch) that let an AI assistant work with the files inside a single root directory.
read_file— read a text file in any language/legacy Windows encoding; binary files come back base64-encoded withis_binary=True; per-call encoding andmax_sizeoverrides (can only lower the configured cap).list_dir— list a folder, optionally recursive (max_depthup to 100), with a glob name filter and hidden-file inclusion; returns name, relative path, size, modified time, and dir/file/symlink flags.search_files— content search via ripgrep: regex or plain pattern, file glob filter, case sensitivity, up to 10 context lines, capped atmax_results(withtruncatedflag).glob— find files by pattern (e.g.**/*.md); patterns cannot contain..; up to 10,000 results.write_file— create/overwrite a file atomically (temp file + rename), optionally creating parent directories; refused in read-only mode (the default).patch_file— replace an exact string, preserving encoding and line endings, atomically, returning the replacement count; refused in read-only mode.Safety constraints that bound all of the above — every resolved path must stay inside the single configured root (
FILE_BRIDGE_ROOT_PATH, required; whole drives/home folders refused); symlinks/junctions pointing outside are neither listed, searched, nor read; files over the max size (default 10 MB) are rejected.Write protections — writes are atomic and the previous version is kept in
.file-bridge/versions, which the AI cannot modify (FILE_BRIDGE_BACKUP_ON_WRITE, default on).Operational limits — stdio transport only: no ports opened, no network calls; logs go to stderr; configuration via
FILE_BRIDGE_*env vars.
File Bridge
A small local MCP server that lets an AI assistant (Claude Desktop, Cursor, VS Code) read and search the files in one folder you choose. It is read-only unless you switch writing on, and it makes no network connections of its own.
What it does not do: when your AI assistant reads a file through the bridge, the assistant sends that text to its own provider (Anthropic, OpenAI, …) under that provider's terms. File Bridge controls which files the assistant can reach; it does not hide their contents from the assistant.
Need client details kept away from the AI? Airgap Private Desk is our Windows app built on this bridge: it replaces names, addresses and account numbers with placeholders before the AI sees a document, and fills them back in on your PC when the AI saves a draft.
Build status: UNSIGNED INTERNAL (no Authenticode certificate yet). See proof-pack/SIGNING.md.
Client / COLP install guide (plain English): CLIENT-README.md.
Quick start (Windows - recommended)
One-command installer (setup may use the internet once; the running bridge makes no network connections):
powershell -ExecutionPolicy Bypass -File .\installer\Install-FileBridge.ps1 -RootPath "C:\Path\To\Your\Files"Add -AllowWrites if the AI should be able to create and edit files. Without it the bridge is read-only.
Post-install smoke test:
powershell -ExecutionPolicy Bypass -File .\scripts\self_test.ps1 -RootPath "C:\Path\To\Your\Files"Details: installer/README.md. Zero-egress proof: proof-pack/.
Uninstall (also removes the connector entries it added to Claude Desktop and Cursor):
powershell -ExecutionPolicy Bypass -File .\installer\Uninstall-FileBridge.ps1Related MCP server: Octofs
Advanced / developer install
pip install airgap-file-bridge
FILE_BRIDGE_ROOT_PATH=/path/to/files airgap-file-bridge --check--check confirms the configuration and exits. --version prints the version.
MCP client config (Claude Desktop, Cursor, VS Code)
Prefer the Windows installer when possible (it writes a local launcher for you). Manual example for Windows, using the full path to the executable:
{
"mcpServers": {
"file-bridge": {
"command": "C:\\Path\\To\\venv\\Scripts\\airgap-file-bridge.exe",
"env": {
"FILE_BRIDGE_ROOT_PATH": "C:/Path/To/Files",
"FILE_BRIDGE_READ_ONLY": "true"
}
}
}
}macOS / Linux, if the command is on PATH:
{
"mcpServers": {
"file-bridge": {
"command": "airgap-file-bridge",
"env": { "FILE_BRIDGE_ROOT_PATH": "/path/to/files" }
}
}
}Configuration
Environment prefix: FILE_BRIDGE_*. Legacy FILESYSTEM_MCP_* names still work when the matching FILE_BRIDGE_* value is unset.
Environment variable | Default | Description |
| (required) | The one folder the AI may use. The bridge will not start without it, and refuses a whole drive or your entire user folder. |
|
| Set to |
|
| Keep the previous version of a changed file in |
| 10 MB | Max file size for operations. A tool call can lower it, never raise it. |
|
| Allow paths through symlinks. Links can never lead outside the folder either way. |
|
| Accept absolute paths (they must still be inside the folder). |
|
| Text encoding. Files saved in older Windows encodings are read automatically. |
|
| Allow a drive root or home folder as the root (not advised). |
|
|
|
Tools
Tool | Description |
| Read a text file (any language, including older Windows encodings). Binary files come back base64-encoded. |
| List a folder, optionally recursively, with a name filter and a depth limit. |
| Search file contents with ripgrep: regex or plain text, context lines, file filters. |
| Find files by pattern, e.g. |
| Write a file atomically. Read-only mode refuses it. |
| Replace exact text. Must match exactly once unless you say otherwise. Keeps encoding and line endings. Read-only mode refuses it. |
Safety behaviour
Every path is resolved and must stay inside the folder. Folder links (symlinks and NTFS junctions) that lead elsewhere are not listed, searched or read.
Search terms are always passed to ripgrep as patterns, never as options, and ripgrep cannot read the MCP channel.
Writes are atomic, and the previous version is kept in
.file-bridge/versions, which the AI cannot change.The bridge talks over stdio only. It opens no ports and makes no network calls.
Development
pip install -e ".[dev]"
pytest -v
ruff check src/ tests/
mypy --config-file mypy.ini --strict src/filesystem_mcpSearch tests need ripgrep (rg) on PATH.
License
MIT
Available Tools
6 toolsglobA
Find files matching a glob pattern.
Uses pathlib's glob matching. Supports recursive patterns (**), hidden file filtering, and result limiting.
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Request model for glob tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | The directory that was searched. |
| total | Yes | Total number of matches found. |
| matches | Yes | List of matching paths relative to root. |
| pattern | Yes | The glob pattern used. |
| truncated | Yes | Whether results were truncated due to max_results. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It adds useful details such as using pathlib's glob matching and supporting recursive patterns, hidden-file filtering, and result limiting. It does not disclose edge-case behaviors like symlink handling or error conditions, so it is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two compact sentences with no filler. The core purpose is front-loaded, and the implementation detail and feature highlights are presented efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the fully documented input schema and the presence of an output schema, the description is largely complete for a glob-finding tool. It adds the key implementation note about pathlib glob semantics, though a small amount of additional usage guidance relative to sibling tools would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for parameters, so the schema already documents path, pattern, recursive, max_results, and include_hidden. The description only lightly reinforces these concepts, which meets the baseline but adds no significant new parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool finds files matching a glob pattern, using a specific verb and resource. It distinguishes itself from file content tools and directory listing tools, though it does not explicitly contrast with the sibling search_files tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when a glob pattern is needed to locate files. However, it does not explicitly state when to prefer an alternative such as search_files or list_dir, leaving some routing decisions to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dirC
List directory contents with optional filtering.
Supports glob pattern filtering, recursive listing, hidden file inclusion, and configurable recursion depth.
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Request model for list_dir tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | The directory path that was listed. |
| total | Yes | Total number of entries returned. |
| entries | Yes | List of directory entries. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It states what the tool supports but not how it behaves in practice—such as default recursion behavior, whether hidden files are excluded by default, error handling, or what the response contains. The read-only nature is implied by the name but never stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded with the core purpose. The second sentence is a compact feature list. It is slightly redundant with the schema's parameter descriptions but does not waste words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values do not need to be described. However, the description lacks usage context, such as how recursion depth interacts with recursive, whether glob matching is relative to the listed directory, and when this tool should be preferred over the glob sibling. It is adequate for a basic listing tool but leaves some call-related ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents path, max_depth, recursive, glob_pattern, and include_hidden. The description's feature list roughly maps to these parameters but adds no new semantic depth beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb and resource: "List directory contents." It also enumerates supported filtering capabilities, which distinguishes it from file content operations like read_file and write_file. However, it does not explicitly differentiate itself from the sibling glob tool, which also deals with path-matching filters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to choose list_dir over glob, search_files, or other siblings. The description only lists features; it does not state scenarios, exclusions, or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_fileA
Apply a targeted patch to a file.
Finds all occurrences of old_str and replaces them with new_str.
Uses atomic write. Returns the number of replacements made.
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Request model for patch_file tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | The path that was patched. |
| new_size | Yes | File size after patch in bytes. |
| old_size | Yes | File size before patch in bytes. |
| replacements | Yes | Number of replacements made. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It proactively discloses three important traits: all occurrences are replaced, the operation uses atomic write, and the tool returns the number of replacements made. It does not spell out no-match or file-not-found behavior, but the core side effects and return signal are covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences, front-loaded with the core action followed by the behavioral guarantee and return value. There is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, the description covers the main behavioral contract and return semantics, and the input schema supplies the nested request fields and encoding default. The main gaps are explicit failure modes and when-not-to-use guidance, which are useful but not critical for invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by explaining that the patch targets every occurrence of old_str, not just the first one, which is a semantic guarantee not explicit in the schema. Path and encoding are already fully described in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with 'Apply a targeted patch to a file,' identifying a specific verb, target, and scope. It further defines the behavior as replacing all occurrences of old_str with new_str, which clearly distinguishes it from write_file (full-file overwrite) and read_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied by the phrase 'targeted patch' and the find/replace semantics, but the description never explicitly says when to prefer patch_file over write_file or states any exclusions. An agent can infer the use case, but the guidance is not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileA
Read a file from the filesystem.
Returns the file content as text. Binary files are returned as base64-encoded strings
with is_binary=True. Supports configurable size limits and encoding.
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Request model for read_file tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | The path that was read. |
| size | Yes | File size in bytes. |
| content | Yes | File content as text. |
| encoding | Yes | Encoding used to read the file. |
| is_binary | Yes | Whether the file was detected as binary. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full behavioral disclosure burden. It does this well by explaining return behavior for text vs binary files, mentioning the `is_binary=True` flag, and noting configurable size limits and encoding. It does not cover error cases like missing files or permission issues, but the core behavioral traits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no redundant words. The primary action is front-loaded, followed by essential return-format details and configurable options. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema (per context signals), the description adequately covers what the agent needs: return text, binary representation, and configurable limits/encoding. It could mention error behavior but is otherwise complete for a read-only file operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, so the schema already documents path, encoding, and max_size thoroughly. The description's reference to 'configurable size limits and encoding' merely echoes the schema without adding deeper meaning, keeping this at the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact action ('Read a file from the filesystem') with a specific verb and resource. It is clearly distinct from sibling tools like list_dir (directory listing), search_files (searching), and write_file/patch_file (modification).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the tool's use case clear: retrieve file content from the filesystem. While it doesn't explicitly mention alternatives or exclusions, the context is direct enough that an agent can infer when to use read_file versus siblings. It lacks explicit 'use this instead of...' guidance, so it doesn't earn a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_filesA
Search file contents using ripgrep (rg).
Requires ripgrep to be installed on the system. Supports regex patterns, glob filtering, case sensitivity, context lines, and result limiting.
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Request model for search_files tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | The directory that was searched. |
| total | Yes | Total number of matches found. |
| matches | Yes | List of matches found. |
| pattern | Yes | The search pattern used. |
| truncated | Yes | Whether results were truncated due to max_results. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It usefully discloses the ripgrep dependency and supported features, but it does not explain behavior such as what happens if ripgrep is missing, search recursion scope, or how results are returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief, front-loaded with the core purpose, and each sentence contributes meaningful information: what it does, the system prerequisite, and the supported options. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate given the rich schema and existing output schema, but it omits practical context like the default search path, how the path relates to a root directory, and when to prefer this over glob. It covers the basics but leaves room for more operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions already cover all parameters (100% coverage), and the description mostly summarizes those same features (regex patterns, glob filtering, case sensitivity, context lines, result limiting). It adds no deeper meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches file contents using ripgrep, identifying the verb, resource, and implementation. It does not explicitly contrast with sibling tools like glob, but 'file contents' helps distinguish it from file-name-based search tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (searching file contents) and lists supported capabilities, but it does not explicitly state when not to use it or how it compares to alternatives like glob or list_dir. Usage context is inferable rather than directly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileA
Write content to a file atomically.
Creates parent directories by default. Uses atomic write (temp file + rename) by default to prevent partial writes. Supports configurable encoding.
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Request model for write_file tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | The path that was written. |
| size | Yes | Number of bytes written. |
| encoding | Yes | Encoding used to write the file. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden, and it does well by disclosing atomic temp-file-plus-rename behavior, default parent-directory creation, and configurable encoding. It does not mention overwrite behavior on an existing file or failure modes, so it is informative but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, with the core action front-loaded and every sentence adding relevant behavior. No repetition of schema boilerplate and no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the nested request schema, complete parameter descriptions, and presence of an output schema, the description provides enough for a capable agent to invoke the tool correctly. It could be more complete with an explicit statement about replacing existing files and when to use patch_file instead, which keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents path, content, atomic, encoding, and create_dirs. The description adds the rationale 'to prevent partial writes' and confirms defaults, but most parameter meaning is already carried by the schema; this is a solid baseline rather than a standout contribution.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and resource: 'Write content to a file atomically,' which makes the tool's core purpose immediately identifiable. It adds useful behavioral details (atomic writes, parent dir creation) but does not explicitly differentiate from patch_file, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to prefer write_file over the sibling patch_file, or what conditions make full-file writes appropriate. The description states behavior rather than selection criteria or exclusions, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.4- First observed
glob - First observed
list_dir - First observed
patch_file - First observed
read_file - First observed
search_files - First observed
write_file
TDQS
Scored across 6 tools
Most tools have clear boundaries, but list_dir and glob overlap significantly: list_dir supports glob filtering, and glob finds files matching patterns, making it easy for an agent to confuse them. read_file, write_file, patch_file, and search_files are otherwise distinct.
Most tools follow a consistent verb_noun pattern like read_file, write_file, and search_files. The exception is glob, which uses a domain-specific single-word name rather than a verb_noun form, creating a minor deviation.
Six tools is a well-scoped size for a file manipulation server. Each tool targets a core file operation without unnecessary redundancy or bloat.
The set covers read, write, patch, listing, searching, and glob matching, which supports most common file workflows. Missing operations like delete, move, or stat are minor gaps that agents can typically work around with existing tools.
Maintenance
Related MCP Connectors
Agent-native MCP server over the public saagarpatel.dev corpus. Read-only, stateless.
- flockfsOAuthcom.flockfs
A real-time, multiplayer filesystem for agents and humans: shared files, live edits, history.
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
1Persistent project context — Rust-native MCP server. IANA-registered .faf format.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceLocal-first MCP server for safely searching, reading, summarizing, tagging, deduplicating, and organizing local files with scoped access, read-only defaults, and dry-run plans.18MIT
- AlicenseNot gradedqualityAmaintenanceThe fastest, most capable filesystem MCP server built in Rust, giving AI agents superpowers to read, search, edit, and manage files and directories.16Apache 2.0
- AlicenseNot gradedqualityBmaintenanceA local filesystem MCP server providing constrained file operations (read/write, directory management, search, metadata) within configurable directories, with read-only mode and zero runtime dependencies.2 npmMIT
- AlicenseCqualityBmaintenanceLocal-first MCP runtime for coding agents with bounded workspace access, content-preconditioned writes, AST search, LSP navigation and diagnostics, and Git status/diff. Designed to give coding agents useful repository access without treating unrestricted shell access as the default integration boundary.133MIT