Build a Safe File-System MCP Server

File tools are deceptively dangerous because a simple path argument can become arbitrary filesystem access.

Define a root directory in server configuration

Resolve every requested path against a configured workspace and verify the resolved path remains inside it. Do not trust string-prefix checks alone.

from pathlib import Path
ROOT = Path("/srv/workspace").resolve()

def safe_path(relative: str) -> Path:
    candidate = (ROOT / relative).resolve()
    if ROOT not in candidate.parents and candidate != ROOT:
        raise ValueError("Path escapes workspace")
    return candidate

Separate read and write tools

Make read_file, write_file, and delete_file distinct. Hosts can then require approval only for mutation/destructive tools.

Block sensitive files

Consider denying credential files, SSH material, environment files, and hidden system paths even if they fall within the workspace.