crav-mcp-filesystem
Verified Safeby CR-AudioViz-AI
Overview
Model Context Protocol (MCP) server for file system operations, enabling AI to autonomously manage and validate files with security sandboxing.
Installation
docker run -p 3003:3003 -v /data:/tmp/javari-builds --env-file .env crav-mcp-filesystemEnvironment Variables
- MCP_API_KEY
- STORAGE_PATH
- MAX_FILE_SIZE
- PORT
- NODE_ENV
Security Notes
The server includes robust path sanitization to prevent directory traversal, file type whitelisting, and size limits. API key authentication and rate limiting are implemented. However, the `execAsync` command for TypeScript validation runs `npx tsc --noEmit` with a user-controlled `cwd` (workspace directory). While `tsc --noEmit` is generally safe, any shell injection vulnerability in `workspaceId` (though mitigated by `path.join`) or unexpected behavior of `tsc` in a malicious context could be a theoretical concern. Additionally, `SUPABASE_ANON_KEY` is hardcoded in some files, though it's typically for client-side use and not a service-level secret.
Similar Servers
files-stdio-mcp-server
Provides sandboxed filesystem access for AI agents to explore directories, read/search file content, and safely edit text files with checksum verification.
vulcan-file-ops
Transforms desktop AI assistants into powerful development partners by providing secure, user-controlled filesystem operations and code manipulation capabilities.
fastfs-mcp
Enables AI assistants (like Claude) to interact with local filesystems, manage Git repositories, and engage users through interactive prompts via a standardized JSON-based protocol.
mcp-sqlite-tools
A Model Context Protocol (MCP) server for LLMs to safely and efficiently interact with local SQLite databases, providing comprehensive operations from schema management to query execution and transactions.