Reported issues for mcp-server-cloud-fs

Pod holds 16 of 16 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to mcp-server-cloud-fs.

Most discussed

Security: Path Traversal in path-utils.ts allows reading files outside allowed roots

I have discovered a Path Traversal vulnerability in that allows users to bypass root confinement.

Vulnerability: The function implements a simple stack-based normalization for segments. However, it does not prevent 'root underflow'. If a path starts with enough segments, the stack remains empty, and the resulting normalized key is relative to the system root (or the bucket root) rather than the configured root prefix.

Example: If a root is configured as , a path like will be normalized to

Read the thread · 2026-06-12 · open · external user · 0 comments

feat: patch_file macro tool for unified read-diff-write operations

Summary

Currently, an LLM must: (1) read_file, (2) compute changes, (3) call edit_file. The patch_file tool accepts a unified diff or line-based patch and applies it atomically in a single tool call.

Proposed Solution

• New patch_file tool in src/tools/patch.ts
• Supports unified format: standard unified diff hunks (@@ -start,count +start,count @@)
• Supports line_replace format: simpler line-range replacement blocks
• Optional expected_etag for concurrency safety (uses Fe

Read the thread · 2026-05-18 · closed · 0 comments

feat: optimistic concurrency control via ETags in VFS

Summary

When multiple agents concurrently modify the same object, the last write silently wins. ETag-based conflict detection gives edit_file the ability to reject stale writes.

Proposed Solution

• Add optional etag field to VfsStat (SHA-256 content hash)
• Compute etag on put(), persist in inode overlay
• Add optional expected_etag parameter to edit_file
• If current etag != expected_etag, reject with conflict error
• Include etag in read_text_file response metadata
• Add

Read the thread · 2026-05-18 · closed · 0 comments

feat: get_file_schema and summarize_file AI-native tools

Summary

LLMs currently must read entire files to understand their structure. For CSVs, JSONs, and large text files, this wastes context tokens. Two lightweight tools that extract structural metadata server-side dramatically reduce cognitive load.

Proposed Solution

• get_file_schema: For CSV, parse headers and infer column types from sample rows. For JSON, extract shape (keys, nesting, array vs object). For other text, return line/byte counts.
• summarize_file: Return file size, line

Read the thread · 2026-05-18 · closed · 0 comments

feat: DLP middleware for PII/secret redaction in tool responses

Summary

When LLM agents read files from cloud storage, sensitive content (API keys, PII, credentials) is sent to the LLM context window. A server-side DLP interceptor should automatically redact known sensitive patterns before content leaves the server.

Proposed Solution

• Create src/middleware/dlp.ts with regex-based content sanitization
• Default patterns: AWS keys, emails, SSN, credit cards, JWTs, generic API keys
• Opt-in via --enable-dlp CLI flag
• Wraps tool handler responses

Read the thread · 2026-05-18 · closed · 0 comments

feat: dynamic tool filtering based on OAuth scopes

Summary

When an MCP client authenticates with a read-only OAuth token, the server currently still exposes write, delete, and shell tools in tools/list. This wastes LLM context tokens and creates security risk from tool hallucination.

Proposed Solution

• Add optional grantedScopes to ServerContext
• Conditionally skip tool registration based on scope membership
• Export getToolsForScopes() helper from src/auth/scopes.ts
• When scopes are set, a read-only client won't even see `

Read the thread · 2026-05-18 · closed · 0 comments

feat: Connection health-check CLI command and /health endpoint

Connection Health-Check UI

Problem

Users frequently struggle with cloud storage configuration — wrong credentials, incorrect endpoints, bucket permissions, region mismatches. Errors only surface when an MCP client tries to use a tool, leading to a poor first-run experience.

Design

Goal

A lightweight localhost web UI that helps users verify their cloud connection before connecting an MCP client. Accessible at http://localhost:3000/health when running with HTTP transport, or as

Read the thread · 2026-05-14 · closed · 0 comments

feat: OIDC & Managed Identity support for Azure

OIDC & Managed Identity Support

Problem

Current authentication to cloud providers relies on static credentials via environment variables (AWS_ACCESS_KEY_ID, AZURE_STORAGE_CONNECTION_STRING). In production:

1. Security risk — long-lived secrets can be leaked or stolen
2. Rotation burden — manual credential rotation is error-prone
3. Non-standard — enterprises use federated identity (OIDC, IRSA, Managed Identity)

Cloud SDKs already support these through their default crede

Read the thread · 2026-05-14 · closed · 0 comments

Most recent

feat: Multi-provider routing (Cloud Hub mode)

Multi-Provider Routing ("Cloud Hub")

Problem

Currently, a single server instance is locked to one provider type (S3 OR Azure OR GCS). Users managing multi-cloud environments need separate server instances for each provider. This is operationally complex and wastes resources.

Design

Goal

A single cloud-fs-mcp instance routes requests to the correct provider based on the URI scheme:

cloud-fs-mcp multi s3://prod-data az://backups gs://ml-models

Architecture

Read the thread · 2026-05-14 · closed · 0 comments

feat: Descriptive cloud-aware error handling

Descriptive Cloud-Aware Error Handling

Problem

Current error handling uses generic catch-all messages. Cloud storage failures have specific, actionable causes that should be surfaced: rate limiting, region mismatches, permission denied, bucket not found, etc.

Design

Error Taxonomy

Read the thread · 2026-05-14 · closed · 0 comments

feat: Object versioning tools (list_versions, restore_version)

Object Versioning Tools (list_versions, restore_version)

Problem

Cloud object stores with versioning maintain complete history. AI agents that write files need the ability to undo mistakes. Currently, no MCP tool exposes versioning.

Design

New Tools

1. list_versions

server.registerTool("list_versions", {
  inputSchema: z.object({
    path: z.string(),
    max_versions: z.number().int().positive().default(20),
  }),
});

Returns array of `{ versionId

Read the thread · 2026-05-14 · closed · 0 comments

feat: Object metadata & tag search tools

Object Metadata & Tag Search Tools

Problem

Cloud objects are more than just bytes — they carry metadata (Content-Type, Cache-Control, custom headers) and tags (key-value pairs for classification, cost allocation, lifecycle management). The current toolset treats objects as opaque files, missing these cloud-native capabilities.

Use cases:

• "Find all objects tagged environment=production"
• "Show me the metadata for this config file"
• "Tag all CSV files under data/ with `depa

Read the thread · 2026-05-14 · closed · 0 comments

feat: get_presigned_url tool for temporary download/upload URLs

get_presigned_url Tool

Problem

When an LLM needs to share a cloud-stored file with the user (e.g., an image, PDF, or large dataset), it currently has two bad options:

1. read_file — downloads the entire file and returns it as text/base64 in the response (expensive, hits token limits)
2. Tell the user to go find it — provides the s3:// URI which isn't directly accessible via browser

Cloud providers support presigned URLs — temporary, authenticated HTTPS URLs that grant

Read the thread · 2026-05-14 · closed · 0 comments

feat: Audit logging for tool invocations

Audit Logging for Tool Invocations

Problem

Enterprise environments require visibility into what the LLM did with cloud storage access. Currently, there is no structured audit trail of which tools were called, what resources were accessed, or what data was modified. The existing --request-logging flag logs HTTP requests but not MCP tool-level semantics.

Design

Log Format

Structured JSON log entries emitted to stderr (following MCP convention):

{
  "timestamp": "202

[Read the thread](https://github.com/nogoo9/mcp-server-cloud-fs/issues/13) · 2026-05-14 · closed · 0 comments

### feat: Streaming & chunked file reading (read_file_chunk)

# Streaming & Chunked File Reading

## Problem

The current `read_file` / `read_text_file` tools download the **entire file** into memory before returning it to the LLM. For large files (logs, CSVs, datasets), this causes:

1. **Memory pressure** — multi-MB files held in Buffer
2. **Token overflow** — LLM context windows can't handle large responses
3. **Timeouts** — slow downloads for large objects
4. **Missed optimization** — S3 and Azure support server-side byte-range reads and S3 Select (SQL

[Read the thread](https://github.com/nogoo9/mcp-server-cloud-fs/issues/12) · 2026-05-14 · closed · 0 comments

### feat: Expose bucket hierarchies as MCP Resources

# Expose Bucket Hierarchies as MCP Resources

## Problem

Currently, all interactions with cloud storage go through MCP **Tools** (e.g., `list_directory`, `read_file`). This forces the LLM to explicitly call `list_directory` before it can "see" the file structure, consuming extra tokens and round-trips. The MCP specification includes a **Resources** primitive designed for exactly this — exposing data the LLM can browse in its context window without explicit tool calls.

## Design

### Resource U

[Read the thread](https://github.com/nogoo9/mcp-server-cloud-fs/issues/11) · 2026-05-14 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/nogoo9/mcp-server-cloud-fs/issues).