← All scanned servers

Trust Card · Static snapshot

mcp-filesystem U

Ungraded — insufficient static coverage · 0 findings (0 critical) · scope broad · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream modelcontextprotocol/servers @ 51b6382 (2026-10-19)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 24 analyzed / 27 discovered files; 1 unsupported source files; 3 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

File coverage, applied rules and scan limits
{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "Unsupported source present"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 27,
  "analyzedFiles": [
    {
      "path": "__tests__/bin-smoke.test.ts",
      "scope": "code",
      "bytes": 2045,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/eras.test.ts",
      "scope": "code",
      "bytes": 6848,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/helpers.ts",
      "scope": "code",
      "bytes": 3227,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/lib.test.ts",
      "scope": "code",
      "bytes": 37564,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/path-utils.test.ts",
      "scope": "code",
      "bytes": 14415,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/path-validation.test.ts",
      "scope": "code",
      "bytes": 47584,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/roots-utils.test.ts",
      "scope": "code",
      "bytes": 4276,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/server-paths.test.ts",
      "scope": "code",
      "bytes": 13996,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/server-roots.test.ts",
      "scope": "code",
      "bytes": 25912,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/server-tools.test.ts",
      "scope": "code",
      "bytes": 49569,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/stdio.test.ts",
      "scope": "code",
      "bytes": 9310,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/version.test.ts",
      "scope": "code",
      "bytes": 1497,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "__tests__/win32.test.ts",
      "scope": "code",
      "bytes": 4632,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "index.ts",
      "scope": "code",
      "bytes": 6324,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "lib.ts",
      "scope": "code",
      "bytes": 22894,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "package.json",
      "scope": "data",
      "bytes": 1715,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "path-utils.ts",
      "scope": "code",
      "bytes": 4494,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "path-validation.ts",
      "scope": "code",
      "bytes": 3708,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "roots-utils.ts",
      "scope": "code",
      "bytes": 2903,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "server.ts",
      "scope": "code",
      "bytes": 35051,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "tsconfig.json",
      "scope": "data",
      "bytes": 314,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "tsconfig.test.json",
      "scope": "data",
      "bytes": 546,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "version.ts",
      "scope": "code",
      "bytes": 1378,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "vitest.config.ts",
      "scope": "code",
      "bytes": 825,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    "Dockerfile"
  ],
  "excludedFiles": [
    {
      "path": "CHANGELOG.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Dockerfile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.

Permissions

Scope: broad · Shell: disabled · Network egress: no · File deletion: enabled · Human approval: none

Provenance

License: SEE LICENSE IN LICENSE · Lockfile: no · Security policy: no · Signals: unverified origin

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem. Scores move with every upstream commit; pages refresh weekly. How scoring works.