"filesystem" matching MCP servers:

Provides a hardened filesystem interface that lets a local model read and write files only within user-specified directories, with symlink protection and atomic operations.

Enables MCP-compatible AI assistants to list, inspect, read, search, and modify local files and directories within configured filesystem roots, with permission controls and optional read-only or deletion restrictions.

Enables AI agents to safely read and write files in a sandboxed workspace via natural language, with on-demand connection, CVE-hardened path confinement, injection resistance, and full audit logging.

Node.js server implementing Model Context Protocol for secure read-only filesystem operations, allowing Claude to read files, list directories, search files, and get file metadata within specified directories.

Enables secure filesystem access with privacy controls using .mcpignore files to block MCP clients from reading or writing sensitive files and directories while allowing directory browsing and search.

Enables reading and verifying C2PA Content Credentials from images and videos through both embedded manifests and invisible watermarks. Supports direct filesystem access, URL checking, and provides structured provenance data including creator identity, AI generation info, and content authenticity.

A security-focused Model Context Protocol server that enables controlled local tool execution through strict network firewalls, filesystem protections, and rate-limiting policies. It features a plugin-based architecture for progressive tool discovery and includes reference implementations for web searching and bug tracking.

Policy-enforcing MCP proxy that blocks dangerous tool calls before they execute. Protects credentials, filesystem, shell, and databases across Claude Desktop, Cursor, Windsurf, and OpenClaw.

Enables AI agents to perform read-only low-level disk forensics and data recovery by opening physical drives or disk images, scanning filesystem structures, testing in-memory patches, and extracting recovered files.

Enables MCP clients to securely connect to a paired Windows machine through a self-hosted Cloudflare relay and use its local filesystem and command-execution tools over Streamable HTTP and WebSocket.

Enables MCP clients such as ChatGPT and MCP Inspector to securely read and manage files within explicitly allowed local directories over MCP Streamable HTTP, with OAuth support and enforced filesystem restrictions.

Enables a remote MCP client to access narrowly scoped local filesystem resources and process capabilities through a loopback-only bridge. Supports guarded file reads, searches, and mutations, authenticated transport, and private reachability via OpenAI Secure MCP Tunnel.

Enables self-hosted remote access to a user-controlled device's approved filesystem roots, allowing clients to list directories, read and search files, inspect metadata, ping the agent, and list devices through an MCP tunnel.

Grants an agent a bounded view of the filesystem where each directory is declared explicitly with a role (reference, sourcecode, workspace) that caps operations to read, write, or delete, resolving every path through a single confinement and permission checkpoint. Common secrets such as .env, keys, and .git are filtered from both access and listings, and deletions only move files into a per-root trash instead of erasing them.

A security-hardened MCP server that enables AI models to safely interact with Obsidian vaults through sandboxed file operations and todo tracking. It implements strict validation layers and resource limits to protect the local filesystem from potentially hostile tool calls.

Enables local AI models to perform defensive cybersecurity analysis through narrowly scoped read-only tools for host posture, Windows security operations, file/IOC triage, code scanning, and allowlisted filesystem/network access while enforcing boundaries and audit trails.

Enables MCP clients like ChatGPT to securely access and manage a controlled local directory over a remote, OAuth-protected endpoint, with configurable filesystem roots and ngrok tunneling.

MCP server that vets LLM-emitted shell commands BEFORE execution — detects rm -rf nested deep in chains, package-manager glob removal (apt remove 'nvidia'), dd/mkfs filesystem destruction, chmod 777 / chown -R privilege blast, network-exfil via curl | bash, chained shutdown/reboot, git destructive ops. 30 detection rules across 8 families. Sub-second, local, free, MCP-native.

Enables agent hosts to perform guarded, undoable filesystem operations confined to registered workspaces: atomic whole-file writes, file and directory create/copy/move/delete, staged literal text and line-range edits, patch application, and search, all journaled with content-addressed blobs. Every mutation returns an operation id and undo availability so history can be inspected and safely reverted with conflict detection, while credential-shaped targets are refused and errors come back as structured data with stable codes.

Runs read-only, offline static scans of the local machine's MCP server configs and agent skill folders, surfacing prompt injection, hidden Unicode, dangerous commands, credential paths, hardcoded secrets, unpinned packages, and over-broad filesystem or transport scope as text, JSON, SARIF, or HTML reports an agent can act on. Also allows scanning a single downloaded skill folder or a saved tools/list JSON so an agent can vet third-party components before installing them.

A read-only MCP server that lets an agent audit its own environment by discovering local MCP configurations and skill folders on Windows, macOS, and Linux and running offline static checks for prompt injection, hidden instructions, hardcoded secrets, dangerous commands, unpinned packages, and excessive filesystem or transport permissions. It exposes tools to scan everything discovered, list configurations, vet a single skill, or analyze supplied text, returning text, JSON, SARIF, or HTML findings with CI-friendly severity levels.