"Filesystem" matching MCP servers:

Provides a hardened filesystem interface that lets a local model read and write files only within user-specified directories, with symlink protection and atomic operations.

Enables AI agents to safely read and write files in a sandboxed workspace via natural language, with on-demand connection, CVE-hardened path confinement, injection resistance, and full audit logging.

Node.js server implementing Model Context Protocol for secure read-only filesystem operations, allowing Claude to read files, list directories, search files, and get file metadata within specified directories.

Enables secure filesystem access with privacy controls using .mcpignore files to block MCP clients from reading or writing sensitive files and directories while allowing directory browsing and search.

Enables reading and verifying C2PA Content Credentials from images and videos through both embedded manifests and invisible watermarks. Supports direct filesystem access, URL checking, and provides structured provenance data including creator identity, AI generation info, and content authenticity.

A security-focused Model Context Protocol server that enables controlled local tool execution through strict network firewalls, filesystem protections, and rate-limiting policies. It features a plugin-based architecture for progressive tool discovery and includes reference implementations for web searching and bug tracking.

Policy-enforcing MCP proxy that blocks dangerous tool calls before they execute. Protects credentials, filesystem, shell, and databases across Claude Desktop, Cursor, Windsurf, and OpenClaw.

Enables a remote MCP client to access narrowly scoped local filesystem resources and process capabilities through a loopback-only bridge. Supports guarded file reads, searches, and mutations, authenticated transport, and private reachability via OpenAI Secure MCP Tunnel.

Grants an agent a bounded view of the filesystem where each directory is declared explicitly with a role (reference, sourcecode, workspace) that caps operations to read, write, or delete, resolving every path through a single confinement and permission checkpoint. Common secrets such as .env, keys, and .git are filtered from both access and listings, and deletions only move files into a per-root trash instead of erasing them.

A security-hardened MCP server that enables AI models to safely interact with Obsidian vaults through sandboxed file operations and todo tracking. It implements strict validation layers and resource limits to protect the local filesystem from potentially hostile tool calls.

Enables local AI models to perform defensive cybersecurity analysis through narrowly scoped read-only tools for host posture, Windows security operations, file/IOC triage, code scanning, and allowlisted filesystem/network access while enforcing boundaries and audit trails.

Enables MCP clients like ChatGPT to securely access and manage a controlled local directory over a remote, OAuth-protected endpoint, with configurable filesystem roots and ngrok tunneling.

MCP server that vets LLM-emitted shell commands BEFORE execution — detects rm -rf nested deep in chains, package-manager glob removal (apt remove 'nvidia'), dd/mkfs filesystem destruction, chmod 777 / chown -R privilege blast, network-exfil via curl | bash, chained shutdown/reboot, git destructive ops. 30 detection rules across 8 families. Sub-second, local, free, MCP-native.