{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_3xygp4rd7jvk","handle":"fsguard-mcp","url":"https://wellknown.network/agents/fsguard-mcp","links":{"self":"https://wellknown.network/agents/fsguard-mcp/record.json","html":"https://wellknown.network/agents/fsguard-mcp","markdown":"https://wellknown.network/agents/fsguard-mcp/record.md","api":"https://wellknown.network/api/v1/agents/fsguard-mcp","status":"https://wellknown.network/api/v1/agents/fsguard-mcp/status","claim":"https://wellknown.network/agents/fsguard-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/fsguard-mcp/claim.json","badge":"https://wellknown.network/agents/fsguard-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/fsguard-mcp/history","tools":"https://wellknown.network/api/v1/agents/fsguard-mcp/tools"},"ard":{"identifier":"urn:air::server:fsguard-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"fsguard-mcp","summary":"Filesystem + git MCP server confined by symlink-resolved path containment, not string prefix matching.","description":"# fsguard-mcp\n\nA filesystem + git MCP server that confines every operation to an allowed\ndirectory tree using **symlink-resolved path containment**, not string\nprefix matching.\n\n## Why this exists\n\nAnthropic's own official filesystem and git MCP servers (`@modelcontextprotocol/server-filesystem`, part of `modelcontextprotocol/servers`, 89.7k★) have carried **five separate path-confinement CVEs across two servers in ten months**, and the pattern is still active:\n\n- **CVE-2025-53109 / CVE-2025-53110** (filesystem, CVSS 8.4/7.3) — the \"allowed directory\" check used naive `startsWith()` prefix matching, defeated by symlinks and by sibling directories that merely *share a string prefix* (e.g. an allowed `/home/user-safe` also matches `/home/user-safe-evil`), giving filesystem-wide read/write and a documented RCE path.\n- **CVE-2025-68143 / CVE-2025-68144 / CVE-2025-68145** (git) — `git_init` accepted arbitrary unvalidated paths, `git_diff`/`git_checkout` passed user-controlled arguments straight to the `git` CLI (argument injection), and `--repository`-confined mode didn't actually verify `repo_path` stayed inside the confined directory.\n- **CVE-2026-27735** (git, disclosed ~2 months before this project started) — `git_add`, implemented via GitPython's `repo.index.add()`, doesn't enforce working-tree boundaries for `../`-style paths, allowing staging and exfiltrating files outside the repo.\n- A documented RCE chain: `git_init` in a writable directory → a malicious `.git/config` with a \"clean\" filter → a `.gitattributes` that applies it → `git_add` triggers the filter → arbitrary shell command runs.\n\nEvery one of these was patched with *another string/prefix check bolted onto that one function*. Nobody moved the boundary enforcement to a place a new tool can't simply forget to include — which is exactly how the fourth CVE landed four months after the first three were \"fixed.\"\n\n## How fsguard-mcp is different\n\n1. **One safety primitive, used everywhere.** Every tool — file…","publisher":{"name":"Berkant Acun","url":null},"homepage":null,"repository":null,"version":"0.1.0","license":"MIT","protocols":["mcp"],"tags":["filesystem","git","mcp","model-context-protocol","sandbox","security"],"pricing":null,"endpoints":[{"url":"pypi:fsguard-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"dev.version-control","name":"Version Control","confidence":1,"provenance":"declared"},{"slug":"dev.filesystem","name":"Filesystem","confidence":1,"provenance":"declared"},{"slug":"code.execution","name":"Code Execution","confidence":1,"provenance":"declared"}],"categories":["code","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"fsguard-mcp","registry":"pypi","observedAt":"2026-09-15T15:24:29.350Z","publishedAt":"2026-08-23T21:34:47.188141Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"fsguard-mcp","url":"https://pypi.org/project/fsguard-mcp/","firstSeenAt":"2026-09-09T16:23:02.887Z","fetchedAt":"2026-09-15T15:22:22.792Z","normalizedAt":"2026-09-15T15:22:22.792Z"}]},"firstSeenAt":"2026-09-09T16:23:02.887Z","updatedAt":"2026-09-15T15:24:29.351Z"}