Skip to main content
Glama

basic-fns-mcp

A streamable-HTTP/stdio MCP server exposing the core filesystem, shell, search, and listing tools that mirror the default agent toolset.

Tools

Tool

Hint

Purpose

read

readOnly

Read a text file with cat-style line numbers

write

destructive

Create or overwrite a file atomically

mkdir

destructive

Create a directory and any missing parents

edit

destructive

Targeted string replacement in a text file

bash

destructive

Execute a shell command and capture output/exit code

grep

readOnly

Search file contents by regex (uses rg --no-ignore if available, with a Python fallback)

find

readOnly

Find files/directories by glob-style name match

ls

readOnly

List directory contents

All filesystem paths are resolved relative to the configured server root. The server refuses any path that resolves outside that root, including symlinks that escape it.

Related MCP server: MCP File Server

Quick start

Install and run over HTTP:

uv sync
uv run basic-fns-mcp --root . --port 8080

Add it to Claude Code:

claude mcp add --transport http basic-fns http://127.0.0.1:8080/mcp

stdio

The same server runs over stdio, where the client spawns it as a subprocess:

uv run basic-fns-mcp --stdio            # or: --transport stdio

Add it to Claude Code:

claude mcp add basic-fns -- uv run --directory /path/to/basic-fns-mcp basic-fns-mcp --stdio

Or in an MCP client config file:

{
  "mcpServers": {
    "basic-fns": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/basic-fns-mcp", "basic-fns-mcp", "--stdio"],
      "env": { "BASIC_FNS_ROOT": "/path/to/your/project" }
    }
  }
}

On stdio, stdout is the protocol channel — the startup banner is suppressed and all logging goes to stderr. The --host/--port flags are ignored.

The module can also be served directly, since tools are registered at import time:

uv run fastmcp run src/basic_fns_mcp/server.py

CLI flags / environment variables

Flag

Environment variable

Default

Meaning

--root

BASIC_FNS_ROOT

current working directory

Sandbox root; all paths resolve under it

--host

BASIC_FNS_HOST

127.0.0.1

HTTP bind address

--port

BASIC_FNS_PORT

8080

HTTP bind port

--max-read-bytes

BASIC_FNS_MAX_READ_BYTES

2_000_000

Refuse read for files larger than this

--max-output-chars

BASIC_FNS_MAX_OUTPUT

100_000

Cap any tool result to this length

--bash-timeout

BASIC_FNS_BASH_TIMEOUT

120

Default shell timeout in seconds

--read-only

BASIC_FNS_READ_ONLY

false

Disable write, mkdir, and edit

--no-bash

BASIC_FNS_ALLOW_BASH

true

Do not register the bash tool

--transport / --stdio

BASIC_FNS_TRANSPORT

http

http or stdio

Command-line arguments win over environment variables.

Security

  • Path sandbox: read, write, mkdir, edit, grep, find, and ls resolve every path inside --root. Symlinks are followed and checked; any path that resolves outside the root is rejected.

  • bash is not sandboxed: bash runs with the full privileges of the server process. A shell command can cd anywhere, read any file the server user can read, and execute arbitrary code. Only bind to loopback (127.0.0.1) and expose this server to trusted clients.

  • No command blocklist: Blocklists are easily bypassed and create a false sense of security, so none is implemented.

  • Read-only mode: Use --read-only to prevent file modification via this server.

Development

Run the test suite:

uv run pytest -q

License

MIT

Available Tools

7 tools
bashA
Destructive

Execute a shell command and return exit code, stdout, and stderr.

Inputs: command (required), cwd, timeout. Returns: result

editA
Destructive

Replace old_string with new_string in a text file.

Inputs: path (required), new_string (required), old_string (required), replace_all. Returns: result

findA
Read-only

Find files or directories by glob-style name match.

Inputs: path, type, pattern, max_results. Returns: result

grepB
Read-only

Search file contents by regex.

Inputs: pattern (required), glob, path, max_results, +1 more. Returns: result

lsA
Read-only

List the contents of a directory.

Inputs: all, path. Returns: result

readA
Read-only

Read a text file and return its contents with cat-style line numbers.

Inputs: path (required), limit, offset. Returns: result

writeA
Destructive

Create or overwrite a file atomically (temp file + os.replace).

Inputs: path (required), content (required). Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.7/5.0

    Scored across 7 tools

    Disambiguation3/5

    read, grep, find, and ls each target a distinct operation (reading content, searching content, finding files by name, listing directories), but the generic bash tool can perform all of these actions, creating overlap and ambiguity about when to use the specialized tools versus bash.

    Naming Consistency5/5

    All tool names are single lowercase verbs (read, grep, find, ls, write, edit, bash) following a consistent Unix-command style. The naming pattern is uniform and predictable.

    Tool Count5/5

    With 7 tools, the server is well-scoped for a basic file operations server. Each tool addresses a core operation (read, write, edit, search, list), and the count is within the ideal range.

    Completeness3/5

    The server covers create (write), read (read), and update (edit) but lacks an explicit delete, move, or copy operation. The bash tool can work around these gaps, but the dedicated surface is incomplete for full file lifecycle management.

    Maintenance

    ActivityStale
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      D
      maintenance
      Provides secure filesystem operations, HTTP fetching with SSRF protection, JSON validation, artifact logging, and optional Redis key-value storage through both stdio and HTTP transports. Features production-ready security controls including sandbox enforcement, allowlist validation, and comprehensive input validation.
      Apache 2.0
    • A
      license
      Not graded
      quality
      D
      maintenance
      Provides secure, sandboxed filesystem operations including reading, writing, listing, searching, and managing files and directories within a configurable working directory with strict security controls.
      3
      MIT
    • F
      license
      Not graded
      quality
      D
      maintenance
      Provides sandboxed access to local filesystem operations including directory and file management, content search with glob and regex patterns, and binary file support with configurable safety limits.
      -
    • F
      license
      Not graded
      quality
      D
      maintenance
      Provides read-only access to a single directory tree over stdio, enabling list, read, search, and metadata operations with strict path containment to prevent access outside the allowed root.
      -