I
io.github.ellmos-ai/ellmos-filecommander-mcp
vitest
Filesystem MCP server: files, processes, sessions, async search, OCR, archives, safe delete.
No known CVEs
MIT license
Actively maintained
Last commit 0d ago
Works with most clients
Transport: stdio, sse, http
0 tools
Grade F
MCPpedia last refreshed this data
io.github.ellmos-ai/ellmos-filecommander-mcp is an MCP server that filesystem MCP server: files, processes, sessions, async search, OCR, archives, safe delete. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 62/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"filecommander": {
"command": "ellmos-filecommander"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-ellmos-ai-ellmos-filecommander-mcp)
Read me
What io.github.ellmos-ai/ellmos-filecommander-mcp does
Part of the ellmos-ai family.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'vitest' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
62/100across 5 weighted dimensions
0255075100
23
17
12
10
−38
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev2 fixed
CVE-2026-47429critical · fixedCVSS 9.8
When Vitest UI server is listening, arbitrary file can be read and executed
### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. ### Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network (using `--api.host` or [`api.host` config option](https://vitest.dev/config/api.html)) - running the Vitest UI or Browser Mode on Windows ### Details The API handler for `/__vitest_attachment__` uses the deprecated `isFileServingAll
CVE-2025-24964critical · fixedCVSS 9.6
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
### Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. ### Details When [`api` option](https://vitest.dev/config/#api) is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.ellmos-ai/ellmos-filecommander-mcp safe to use?
- io.github.ellmos-ai/ellmos-filecommander-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
- How do I install io.github.ellmos-ai/ellmos-filecommander-mcp?
- io.github.ellmos-ai/ellmos-filecommander-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What AI clients work with io.github.ellmos-ai/ellmos-filecommander-mcp?
- io.github.ellmos-ai/ellmos-filecommander-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is io.github.ellmos-ai/ellmos-filecommander-mcp actively maintained?
- io.github.ellmos-ai/ellmos-filecommander-mcp is actively maintained — last commit was 0 days ago. It has 4 GitHub stars.
Related
Similar servers
Others in other
Headroom95Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
67.6k 3
T
Transport Stdio95Transport for TMCP using STDIO
197 14
Flare95The graph based agentic IDE
167 3
A
app.fojin/fojin-mcp94Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.
332 8
MCP Security Weekly
Get CVE alerts and security updates for io.github.ellmos-ai/ellmos-filecommander-mcp and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.