Filesystem MCP server. What it holds.
The server holds no credential of its own, but it reads files as the account it runs as. That includes whatever credentials are lying in those files. Published by MCP reference server.
The record
Taken from the official documentation linked at the bottom.
| Field | Value |
|---|---|
| Publisher | MCP reference server |
| Authentication | None. Access is configured as a set of allowed paths when the server starts. |
| What it holds | No credential of its own. It reads and writes files as the operating system account it runs as. |
| What that reaches | Every file under the configured roots. On a developer machine that commonly includes .env files, ~/.aws/credentials, SSH keys and the configuration of other MCP servers, which means it can reach the credentials of things it has no relationship with. |
| Risk class | Reads the filesystem The server holds no credential of its own, but it reads files as the account it runs as. That includes whatever credentials are lying in those files. |
Why it matters
The repository describes the server as offering "secure file operations with configurable access controls". The control is the path configuration, so a root set one level too high is the entire finding.
Not whether the server is trustworthy. What it holds, and what that reaches.
What to check
Which roots are configured, and what credentials live under them. If the answer is the home directory, the server reaches everything the developer does.
The same questions apply to any server in this database, which is why the MCP server security page is the general version of this page.
Reads the filesystem
Where this comes from.
Every field above is taken from the official documentation. Where it does not say, this page does not either.
Questions, answered.
The two questions this record answers.
What credential does the Filesystem MCP server hold?
No credential of its own. It reads and writes files as the operating system account it runs as.
What can it reach?
Every file under the configured roots. On a developer machine that commonly includes .env files, ~/.aws/credentials, SSH keys and the configuration of other MCP servers, which means it can reach the credentials of things it has no relationship with.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.