Is Assay MCP Server safe to use?

Assay MCP Server has 2 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "@modelcontextprotocol/server-filesystem". Review the Security section above for details before installing.

How do I install Assay MCP Server?

Assay MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Assay MCP Server do?

Assay MCP Server provides 5 tools: candidate, Quickstart, Ecosystem, Contributing, License. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Assay MCP Server?

Assay MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Assay MCP Server actively maintained?

Assay MCP Server is actively maintained — last commit was 0 days ago. It has 9 GitHub stars.

Assay MCP Server

@modelcontextprotocol/server-filesystem

The firewall for MCP tool calls. Block, audit, replay with evidence bundles.

9 591.8k/wk 5 tools GitHub npm PyPI

2 open CVEs

MIT license

Actively maintained

Last commit 0d ago

Works with most clients

Transport: stdio, sse, http

5 tools · ~118 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 28m ago

Edit this pageView history

Assay MCP Server is an MCP server that the firewall for MCP tool calls. Block, audit, replay with evidence bundles. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 83/100 on MCPpedia's security, maintenance and efficiency rubric.

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-rul1an-assay": {
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-rul1an-assay)](https://mcppedia.org/s/io-github-rul1an-assay)

Read me

What Assay MCP Server does

Your MCP agent calls read_file, exec, web_search — but should it, and what can you honestly prove about that run afterward?

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@modelcontextprotocol/server-filesystem' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

83/100across 5 weighted dimensions

How we score →

0255075100

−17

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 open

CVE-2025-53110high

@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. Thank you to Elad Beber (Cymulate) for reporting these issues.

Affected: >= 0source →

CVE-2025-53109high

@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. Thank you to Elad Beber (Cymulate) for reporting these issues.

Affected: >= 0source →

Inventory

Tools (5)

Click any tool to inspect its schema.

~118 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Assay MCP Server safe to use?: Assay MCP Server has 2 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "@modelcontextprotocol/server-filesystem". Review the Security section above for details before installing.
How do I install Assay MCP Server?: Assay MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Assay MCP Server do?: Assay MCP Server provides 5 tools: candidate, Quickstart, Ecosystem, Contributing, License. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Assay MCP Server?: Assay MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Assay MCP Server actively maintained?: Assay MCP Server is actively maintained — last commit was 0 days ago. It has 9 GitHub stars.

Similar servers

Others in security

View all →

io.github.KryptosAI/mcp-observatory94

Regression testing for MCP servers. Checks capabilities, invokes tools, detects schema drift.

174 4

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

11.6k 3

io.github.wyre-technology/rocketcyber-mcp92

MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

MCP Security Weekly

Get CVE alerts and security updates for Assay MCP Server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-rul1an-assay": {
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-rul1an-assay)](https://mcppedia.org/s/io-github-rul1an-assay)

Read me

What Assay MCP Server does

Your MCP agent calls read_file, exec, web_search — but should it, and what can you honestly prove about that run afterward?

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@modelcontextprotocol/server-filesystem' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Assay

The open, recomputable evidence profile for privileged MCP tool actions.
Assay records what a privileged tool call decided, what was observed, and what stays unproven, so a reviewer can replay the claim offline instead of trusting the agent's account of itself. Enforcement is deterministic and fail-closed, and the enforcing proxy is the reference producer rather than the contract itself. Kernel-level (eBPF/LSM) observation on Linux is an optional stronger vantage. CI-native, no backend, bounded by design.

Quickstart · How it works · See it work · MCP example · OWASP MCP Top 10 · Discussions

Agents got real tool access through MCP — and tool poisoning, rug pulls, and confused-deputy OAuth came with it. Most tools scan a server or filter a prompt. Assay sits at the tool-call boundary and does three things, in order.

One golden path: the release-pinned agent journey records the nine driven CLI/MCP steps and their exit/stdout contracts. Its protected-action fixture lives in examples/privileged-action-gate/.

Enforce, prove, stay honest

Enforce. A deterministic, fail-closed gate decides every tools/call before it runs, with the precise reason for each allow or deny. On Linux it adds real kernel enforcement — an eBPF/LSM IPv4/TCP connect-egress block and a Landlock TCP-connect port allowlist, both opt-in and fail-closed. A policy it cannot express exactly is refused, never half-applied.
Prove. Each decision and observed effect becomes an offline-verifiable, tamper-evident evidence bundle: the verdict, the pre-call establish journey, and declared-vs-observed conformance — all reviewable in CI, with no hosted backend.
Stay honest. Every claim carries its basis (verified, self_reported, inferred, absent), and a gate refuses to let a claim exceed what was observed. A tool returning "success" is the provider's assertion, never proof. Assay ships no single safety score and never claims more than it can prove.

Quickstart

cargo install assay-cli --version 5.4.0 --locked

mkdir -p /tmp/assay-demo && echo "safe content" > /tmp/assay-demo/safe.txt
assay mcp wrap --policy examples/mcp-quickstart/policy.yaml \
  -- npx @modelcontextprotocol/server-filesystem /tmp/assay-demo

✅ ALLOW  read_file  path=/tmp/assay-demo/safe.txt  reason=policy_allow
❌ DENY   read_file  path=/tmp/outside-demo.txt      reason=path_constraint_violation
❌ DENY   exec       cmd=ls                          reason=tool_denied

Project manifests are shipped for Claude Code and Cursor; Codex uses the equivalent TOML entry documented in the editor MCP recipe. assay mcp config-path supports Claude and Cursor only. Python SDK: pip install assay-it. CI: GitHub Action. No hosted backend and no API keys for core flows. New to the threat model?

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

83/100across 5 weighted dimensions

How we score →

0255075100

−17

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 open

CVE-2025-53110high

@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

Affected: >= 0source →

CVE-2025-53109high

@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

Affected: >= 0source →

Inventory

Tools (5)

Click any tool to inspect its schema.

~118 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Assay MCP Server safe to use?: Assay MCP Server has 2 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "@modelcontextprotocol/server-filesystem". Review the Security section above for details before installing.
How do I install Assay MCP Server?: Assay MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Assay MCP Server do?: Assay MCP Server provides 5 tools: candidate, Quickstart, Ecosystem, Contributing, License. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Assay MCP Server?: Assay MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Assay MCP Server actively maintained?: Assay MCP Server is actively maintained — last commit was 0 days ago. It has 9 GitHub stars.