Grants AI agents direct read and write access to the local filesystem. Extremely powerful — and extremely dangerous if misconfigured.
Security Rating
65 / 100
Vendor Type
Official (Anthropic)
Risk Category
High Risk
Exposed Tools & Function Calls
- read_file
- read_multiple_files
- write_file
- edit_file
- create_directory
- list_directory
- move_file
- search_files
- get_file_info
- list_allowed_directories
Required Permission Scopes
- fs:read
- fs:write
- fs:delete (implicit via move)
Vulnerability & Risk Analysis
Path traversal outside allowed directories (Critical)
Malformed paths like ../../etc/passwd or relative path injection may allow agents to read outside configured allowed directories in some implementations.
Fix: Ensure canonical path resolution before allowing access. Use chroot jails for isolation. Regularly audit the allowlist configuration.
Destructive file operations (High)
write_file and move_file can overwrite or effectively delete important files. An agent acting on incorrect instructions or a prompt injection could cause data loss.
Fix: Maintain daily backups. Configure allowed directories to read-only where possible. Require human confirmation for destructive operations.
Sensitive file exposure (High)
If .env files, SSH keys, or configuration files exist within the allowed directory scope, agents can read and potentially exfiltrate them.
Fix: Exclude sensitive file patterns (.env, *.key, *.pem) from the allowlist. Store credentials outside the agent working directory.