npm:@modelcontextprotocol/server-filesystem

scanned 2026-08-27T19:54:33.285Z rulepack rulepack-2026.08.1 transport stdio tools 14

crit 0 high 0 med 9 low 0 info 0

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "read_file" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool read_file · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "read_text_file" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool read_text_file · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "read_media_file" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool read_media_file · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "write_file" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool write_file · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "edit_file" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool edit_file · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "list_directory" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool list_directory · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "list_directory_with_sizes" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool list_directory_with_sizes · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "directory_tree" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool directory_tree · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

medium schema-freeform-sink LLM05 deterministic

Unvalidated free-form input on a sink-like parameter

Parameter "path" of tool "get_file_info" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

at tool get_file_info · field inputSchema.properties.path

{"type":"string"}

reproduce: mcpaudit-scan --npm @modelcontextprotocol/server-filesystem --check schema-freeform-sink

This is an automated, point-in-time report from passive metadata analysis (the server's own initialize and tools/list advertisement). No tools were invoked. The grade reflects deterministic checks only; findings marked "llm" are triage signals for human review and do not affect the grade. Verify any finding with its reproduce command. Rulepack rulepack-2026.08.1.