{
  "schema_version": "1.0",
  "tool": "@modelcontextprotocol/server-filesystem",
  "checks": [
    {
      "id": "read-and-write-tools-exposed",
      "passed": true,
      "observed": {
        "readOnlyHint_read": true,
        "readOnlyHint_write": false
      }
    },
    {
      "id": "allowed-directory-listed",
      "tool": "list_allowed_directories",
      "arguments": {},
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Allowed directories:\n<LAB>/allowed"
          }
        ],
        "structuredContent": {
          "content": "Allowed directories:\n<LAB>/allowed"
        }
      },
      "passed": true
    },
    {
      "id": "read-inside",
      "tool": "read_text_file",
      "arguments": {
        "path": "<LAB>/allowed/note.txt"
      },
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Lab note: public fixture.\n"
          }
        ],
        "structuredContent": {
          "content": "Lab note: public fixture.\n"
        }
      },
      "passed": true
    },
    {
      "id": "overwrite-inside",
      "tool": "write_file",
      "arguments": {
        "path": "<LAB>/allowed/draft.txt",
        "content": "Updated fictional draft.\n"
      },
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Successfully wrote to <LAB>/allowed/draft.txt"
          }
        ],
        "structuredContent": {
          "content": "Successfully wrote to <LAB>/allowed/draft.txt"
        }
      },
      "passed": true
    },
    {
      "id": "read-outside-denied",
      "tool": "read_text_file",
      "arguments": {
        "path": "<LAB>/outside/note.txt"
      },
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Access denied - path outside allowed directories: <LAB>/outside/note.txt not in <LAB>/allowed"
          }
        ],
        "isError": true
      },
      "passed": true
    },
    {
      "id": "write-outside-denied",
      "tool": "write_file",
      "arguments": {
        "path": "<LAB>/outside/new.txt",
        "content": "This should not be written.\n"
      },
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Access denied - path outside allowed directories: <LAB>/outside/new.txt not in <LAB>/allowed"
          }
        ],
        "isError": true
      },
      "passed": true
    },
    {
      "id": "parent-traversal-denied",
      "tool": "read_text_file",
      "arguments": {
        "path": "<LAB>/allowed/../outside/note.txt"
      },
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Access denied - path outside allowed directories: <LAB>/outside/note.txt not in <LAB>/allowed"
          }
        ],
        "isError": true
      },
      "passed": true
    },
    {
      "id": "outside-symlink-denied",
      "tool": "read_text_file",
      "arguments": {
        "path": "<LAB>/allowed/outside-link.txt"
      },
      "result": {
        "content": [
          {
            "type": "text",
            "text": "Access denied - symlink target outside allowed directories: <LAB>/outside/note.txt not in <LAB>/allowed"
          }
        ],
        "isError": true
      },
      "passed": true
    }
  ],
  "version": "2.0.0",
  "tested_at": "2026-10-20T21:28:51.503Z",
  "environment": {
    "platform": "linux",
    "architecture": "x64",
    "node": "v26.7.0"
  },
  "package_integrity": "sha512-JT+bt9wrNIMqhGvOr49vEE9NpbkBxdjQxyLVqh3lYHsB2zGgbzePmDOGrm1glBT1DPR5YvkM6h/NXztWSRhywg==",
  "lock_sha256": "7684c15c7ea5128363a6d6e8a936990ce85f8dcb7d05d9aa815ba20ecececc00",
  "entry_sha256": "ed5efae0e3597236ba1f170ce8d903280c1f58b36dd7a7ad53891ed634c7e996",
  "transport": "stdio",
  "configuration": {
    "allowed_directories": [
      "<LAB>/allowed"
    ],
    "client_roots_capability": false
  },
  "scope": "Synthetic files only; no LLM, desktop integration, OS sandbox, race-condition or exhaustive security testing.",
  "negotiated_protocol": "2025-11-25",
  "server_info": {
    "name": "secure-filesystem-server",
    "version": "2.0.0"
  },
  "tools": [
    {
      "name": "read_file",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "read_text_file",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "read_media_file",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "read_multiple_files",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "write_file",
      "annotations": {
        "readOnlyHint": false,
        "idempotentHint": true,
        "destructiveHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "edit_file",
      "annotations": {
        "readOnlyHint": false,
        "idempotentHint": false,
        "destructiveHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "create_directory",
      "annotations": {
        "readOnlyHint": false,
        "idempotentHint": true,
        "destructiveHint": false,
        "openWorldHint": false
      }
    },
    {
      "name": "list_directory",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "list_directory_with_sizes",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "directory_tree",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "move_file",
      "annotations": {
        "readOnlyHint": false,
        "idempotentHint": false,
        "destructiveHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "search_files",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "get_file_info",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    },
    {
      "name": "list_allowed_directories",
      "annotations": {
        "readOnlyHint": true,
        "openWorldHint": false
      }
    }
  ],
  "passed": true,
  "server_stderr": "Secure MCP Filesystem Server running on stdio\nClient does not support MCP Roots, using allowed directories set from server args: [\n  '<LAB>/allowed'\n]\n"
}