high
MCP filesystem server with access to a very broad path
A filesystem server is allowed to read and write /, a whole home folder, a drive root or a system folder.
Why it matters
The agent can read and write everything under that path, including SSH keys, cloud credentials and browser profiles. A prompt injection in any document it reads can ask for them.
How to fix it
Allow only the project folders the agent needs.
Before
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": [
"@modelcontextprotocol/[email protected]",
"/Users/alex"
]
}
}
}After
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": [
"@modelcontextprotocol/[email protected]",
"/Users/alex/projects/site"
]
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- Unpinned MCP server package or image
- MCP server installs without asking (npx -y)
- MCP server container runs --privileged
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed