{
  "format_version": "0.2.0",
  "report_id": "3ccc9054-f00b-4c12-8815-751955dee8a0",
  "generated_at": "2026-10-11T06:17:50.008Z",
  "subject": {
    "server_name": "io.github.modelcontextprotocol/server-filesystem",
    "publisher_claim": "@modelcontextprotocol",
    "artifact": {
      "ecosystem": "npm",
      "package": "@modelcontextprotocol/server-filesystem",
      "version": "1.0.0",
      "sha256": "ca60ed89a0acdf91a77a54ba21b1c41ea62e801c360320877035fa20ec4909ae",
      "download_url": "https://registry.npmjs.org/@modelcontextprotocol/server-filesystem/-/server-filesystem-1.0.0.tgz",
      "registry_metadata_url": "https://registry.npmjs.org/%40modelcontextprotocol%2Fserver-filesystem/1.0.0",
      "acquired_at": "2026-10-11T06:17:50.008Z",
      "registry_metadata_sha256": "9e2b196cb3e6c9e87a36732d081c4d46a5801388c683eec062db7730671771ce",
      "integrity_claim": "sha512-2fN6qhpsiPSBAe0ev1qDPk4sCWdULCZQTuYc4ZY7+BDWQ1XCxLB+7dqStF2ZflgG4G/9vTwQsjxh7pjFqrrpcg==",
      "integrity_verified": true
    }
  },
  "analysis": {
    "engine": {
      "name": "sentinel",
      "version": "0.2.0",
      "build_sha256": "76ecfa3e5785d89b34d6618b32c84c01f0e40666b3541871cc874aba61200160"
    },
    "protocol_profile": {
      "id": "mcp-2026-07-28",
      "specification_revision": "2026-07-28",
      "local_retrieval_date": "2026-08-01",
      "discovery_status": "not_run"
    },
    "authorization_profiles": [
      {
        "id": "none",
        "credential_present": false,
        "description": "No credentials were supplied."
      }
    ],
    "rule_pack": {
      "version": "0.1.0",
      "sha256": "302d85219dda34199bd2402fcc94ba34233152fe996a128e0b332ac3efef24b3"
    },
    "semantic_analysis": []
  },
  "observations": [
    {
      "id": "observation:package-metadata",
      "kind": "artifact_metadata",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "7af83f7de1e3048563bdad6656322b884e472ad56187c226bdea198809e623b9",
          "artifact_path": "package/package.json",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "name": "@modelcontextprotocol/server-filesystem",
        "version": "1.0.0",
        "mcpName": "io.github.modelcontextprotocol/server-filesystem",
        "description": "MCP server for filesystem access",
        "bin": {
          "mcp-server-filesystem": "dist/index.js"
        },
        "scripts": {
          "build": "tsc && shx chmod +x dist/*.js",
          "prepare": "npm run build",
          "watch": "tsc --watch",
          "test": "vitest run",
          "format": "prettier --write \"**/*.{ts,mts,cts,js,mjs,cjs}\" --ignore-path ../../.prettierignore",
          "format:check": "prettier --check \"**/*.{ts,mts,cts,js,mjs,cjs}\" --ignore-path ../../.prettierignore",
          "lint": "eslint . --max-warnings 0",
          "typecheck": "tsc -p tsconfig.test.json",
          "coverage": "vitest run --coverage",
          "validate": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm run test"
        }
      }
    },
    {
      "id": "observation:file-inventory",
      "kind": "file",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "ca60ed89a0acdf91a77a54ba21b1c41ea62e801c360320877035fa20ec4909ae",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "entry_count": 9,
        "regular_file_bytes": 91820,
        "entries": [
          {
            "path": "package/dist/index.js",
            "type": "file",
            "size": 5519,
            "sha256": "68e6aae96c907bf00089dd48b9f2fdd06113e6588d9915f19852cb468f9296d8"
          },
          {
            "path": "package/dist/lib.js",
            "type": "file",
            "size": 22560,
            "sha256": "551973d86d9ed68c2fc49903c8cdd2dedd4a0a70f3401ddef970ff4bd3e3fa7a"
          },
          {
            "path": "package/dist/path-utils.js",
            "type": "file",
            "size": 4676,
            "sha256": "b686997ed21d09324c341658a170432dc672dcd84a81908f6f28b27fc0acde75"
          },
          {
            "path": "package/dist/path-validation.js",
            "type": "file",
            "size": 3905,
            "sha256": "07fbf314443ad3f4a30ab462b122a18f53bbc895f628e3a5830bca8aed59386b"
          },
          {
            "path": "package/dist/roots-utils.js",
            "type": "file",
            "size": 2784,
            "sha256": "80f4c57f704068d987463f4bafaf6df10047e3075535a589a881d58111f2452d"
          },
          {
            "path": "package/dist/server.js",
            "type": "file",
            "size": 32955,
            "sha256": "36b7f04058bc94f8e3986552aa17ebd56d01847235adf163f6f2b4c8861c6f81"
          },
          {
            "path": "package/dist/version.js",
            "type": "file",
            "size": 1415,
            "sha256": "044a3819acfb25e8038eb742845502eb255fa719aaa158b4befad5a58a44854d"
          },
          {
            "path": "package/package.json",
            "type": "file",
            "size": 1628,
            "sha256": "7af83f7de1e3048563bdad6656322b884e472ad56187c226bdea198809e623b9"
          },
          {
            "path": "package/README.md",
            "type": "file",
            "size": 16378,
            "sha256": "2250f544d7305e9fbfe810e21cc1d1df9577333b50aeaed56b44845ab29ac99c"
          }
        ]
      }
    },
    {
      "id": "observation:registry-metadata",
      "kind": "artifact_metadata",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "9e2b196cb3e6c9e87a36732d081c4d46a5801388c683eec062db7730671771ce",
          "capture_kind": "registry_metadata"
        }
      ],
      "data": {
        "metadata_url": "https://registry.npmjs.org/%40modelcontextprotocol%2Fserver-filesystem/1.0.0",
        "requested_package": "@modelcontextprotocol/server-filesystem",
        "requested_version": "1.0.0",
        "tarball_url": "https://registry.npmjs.org/@modelcontextprotocol/server-filesystem/-/server-filesystem-1.0.0.tgz",
        "integrity_claim": "sha512-2fN6qhpsiPSBAe0ev1qDPk4sCWdULCZQTuYc4ZY7+BDWQ1XCxLB+7dqStF2ZflgG4G/9vTwQsjxh7pjFqrrpcg==",
        "integrity_verified": true
      }
    },
    {
      "id": "observation:runtime-dependencies",
      "kind": "dependency",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "7af83f7de1e3048563bdad6656322b884e472ad56187c226bdea198809e623b9",
          "artifact_path": "package/package.json",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "dependencies": {
          "@modelcontextprotocol/sdk": "^1.31.0",
          "diff": "^8.0.3",
          "glob": "^13.0.6",
          "minimatch": "^10.0.1",
          "zod": "^4.0.0"
        }
      }
    },
    {
      "id": "observation:filesystem-api-b4d9834e2adee885",
      "kind": "code_indicator",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "551973d86d9ed68c2fc49903c8cdd2dedd4a0a70f3401ddef970ff4bd3e3fa7a",
          "artifact_path": "package/dist/lib.js",
          "capture_kind": "artifact_file",
          "byte_range": [
            4722,
            4730
          ]
        }
      ],
      "data": {
        "indicator": "filesystem-api",
        "description": "Source references a filesystem API."
      }
    },
    {
      "id": "observation:filesystem-api-103747feede9d62e",
      "kind": "code_indicator",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "36b7f04058bc94f8e3986552aa17ebd56d01847235adf163f6f2b4c8861c6f81",
          "artifact_path": "package/dist/server.js",
          "capture_kind": "artifact_file",
          "byte_range": [
            4207,
            4224
          ]
        }
      ],
      "data": {
        "indicator": "filesystem-api",
        "description": "Source references a filesystem API."
      }
    },
    {
      "id": "observation:static-tool-inventory",
      "kind": "protocol_inventory",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "ca60ed89a0acdf91a77a54ba21b1c41ea62e801c360320877035fa20ec4909ae",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "extraction": "static_source_analysis",
        "complete": true,
        "incompleteness": [],
        "scanned_files": [
          "package/dist/index.js",
          "package/dist/lib.js",
          "package/dist/path-utils.js",
          "package/dist/path-validation.js",
          "package/dist/roots-utils.js",
          "package/dist/server.js",
          "package/dist/version.js"
        ],
        "tools": [
          {
            "name": "create_directory",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              16294,
              17418
            ],
            "description_sha256": "41f9575cfbbca24813a25f60548cfa0c0cdfb9ad334c92691cc4c2510af5b9e3",
            "description_repr": "source_text",
            "input_schema_sha256": "97bd1f2f11c8c3e0c03a78b52278357bbdf8f70f93024eebbf635dffe2581a4e",
            "input_schema_repr": "source_text"
          },
          {
            "name": "directory_tree",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              21470,
              24111
            ],
            "description_sha256": "2a313b366110172f66fc0c55e8c4a95e2a42fe3b5f212da1275c161e6f9f4444",
            "description_repr": "source_text",
            "input_schema_sha256": "7f6d7884a8a08a093ffbc7eafcc628d4fb0299cc7cc145af81de85315dc70580",
            "input_schema_repr": "source_text"
          },
          {
            "name": "edit_file",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              15360,
              16288
            ],
            "description_sha256": "7d0ab093914fe29e5f31840e8b79351595959f9568fead0a12e3868ad9c83864",
            "description_repr": "source_text",
            "input_schema_sha256": "d7de7a42aa04545a65314f69ba7cfd692276794f48a45403bf411b2c17c23f06",
            "input_schema_repr": "source_text"
          },
          {
            "name": "get_file_info",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              26642,
              27688
            ],
            "description_sha256": "38f9c18bc6ae856264acc674a1e7a53f837342bb34fe8fa07086c0e0beaf9f1b",
            "description_repr": "source_text",
            "input_schema_sha256": "baf3921efff65aac5889103fe3227ae9f05d3c687f6ae23e77f81ce33264ce45",
            "input_schema_repr": "source_text"
          },
          {
            "name": "list_allowed_directories",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              27694,
              28513
            ],
            "description_sha256": "7511f1d76c37638756c818ce1264d2f88fa1e96c352acf0abe031249a8a305b5",
            "description_repr": "source_text",
            "input_schema_sha256": "eabe566b12edccb13a42cec6f8adf3748c772a69f9f14bfa9c471fef1399f9cf",
            "input_schema_repr": "source_text"
          },
          {
            "name": "list_directory",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              17424,
              18555
            ],
            "description_sha256": "1514d8174175c7fb2cb094f8beac60eec2d7d1159f9b782fdd4d9bb267ac8b78",
            "description_repr": "source_text",
            "input_schema_sha256": "d08ab695a79df5767e8b2c6afe80d6d50321e9ade44aa8b24f5f82b0a1c1df87",
            "input_schema_repr": "source_text"
          },
          {
            "name": "list_directory_with_sizes",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              18561,
              21464
            ],
            "description_sha256": "2624bece083bad8f7ec5110acd23b84149eb7183d14ba08bac5d228f632e5ad8",
            "description_repr": "source_text",
            "input_schema_sha256": "bf5409b6aeeb196c716c2b2c3b872fe797deab1906950a47edbf824c0f66df23",
            "input_schema_repr": "source_text"
          },
          {
            "name": "move_file",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              24117,
              25387
            ],
            "description_sha256": "373b0c53f89e7ce84cebe79b100275a67c065a9b65dafcc9989d01323ca4c028",
            "description_repr": "source_text",
            "input_schema_sha256": "e866b33c90d7571ae23757cbfbe151364cc5ca15bd5ef0f0141ae9847321246c",
            "input_schema_repr": "source_text"
          },
          {
            "name": "read_file",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              8449,
              8859
            ],
            "description_sha256": "7abf56a4c306cf50c1ad1b4568b4d5f28086f068b4052f81aff20e72c0b92d47",
            "description_repr": "string_literal",
            "input_schema_sha256": "6795c6230cba6c7767c9b44ddd2f172dc61b91fff3027618e9720be23e1d057e",
            "input_schema_repr": "source_text"
          },
          {
            "name": "read_media_file",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              10084,
              12915
            ],
            "description_sha256": "3a9bd15bc12b0187826eb13b29cd784209b2d57480ecda7f1071a8dedc31205e",
            "description_repr": "source_text",
            "input_schema_sha256": "fe764266a8306bdcd4a600788ab226e76c8f6ebc3fd7e554d9ab5f8eabe4f096",
            "input_schema_repr": "source_text"
          },
          {
            "name": "read_multiple_files",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              12921,
              14350
            ],
            "description_sha256": "64d353a4e882c9b9266f208da3171ea169b984e9a9e4e150ecb40daeb6efe086",
            "description_repr": "source_text",
            "input_schema_sha256": "5597b7913856b24b0d962c6cb331a4dfd09c2e01f33ce0c8ecaf4b2f95f4f266",
            "input_schema_repr": "source_text"
          },
          {
            "name": "read_text_file",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              8865,
              10078
            ],
            "description_sha256": "cd1ed46753c771d071bb574aacffbb39ee58b840d30df914763c6ced9a0beccd",
            "description_repr": "source_text",
            "input_schema_sha256": "48161c4da0777ff77a529f44c68ec09429630fb745643fdfbcff0126377a2747",
            "input_schema_repr": "source_text"
          },
          {
            "name": "search_files",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              25393,
              26636
            ],
            "description_sha256": "3e69d5733647514efb5f3e516bf693224876f336f491bae5750ac23e4c619306",
            "description_repr": "source_text",
            "input_schema_sha256": "2bbeebf94ffadbbf16d4e1faf7e638cbd2cc440b6bc5597c12e76c9f575539af",
            "input_schema_repr": "source_text"
          },
          {
            "name": "write_file",
            "discovery": "registration",
            "artifact_path": "package/dist/server.js",
            "byte_range": [
              14356,
              15354
            ],
            "description_sha256": "7bc4fff4830da21f34c4a3dd3bf1f16c58988c995dfa0c8554fbe62be1500c1e",
            "description_repr": "source_text",
            "input_schema_sha256": "2ca36577c42a793c81c0b03a6293776410f154a5348fb4bee79b6cd4c53ecb74",
            "input_schema_repr": "source_text"
          }
        ]
      }
    }
  ],
  "findings": [],
  "limitations": [
    {
      "code": "protocol_discovery_not_run",
      "summary": "M1 performs static artifact inspection only; no MCP protocol session was opened."
    },
    {
      "code": "tool_calls_not_performed",
      "summary": "No tools were invoked."
    },
    {
      "code": "semantic_analysis_not_run",
      "summary": "No semantic model analysis was run."
    }
  ]
}