The Filesystem MCP server exposes 14 tools whose definitions cost approximately 2,797 tokens in every single conversation, whether or not any of them is ever called. Against the 19 static rules in the catalogue it scores 96 out of 100 — grade A — raising 24 scored findings in 2 of the six categories.
Its strongest category is surface at 100/100; the weakest is design at 84/100. It is catalogued here under Developer Tools, alongside other servers agents reach for in the same kind of work.
At 2,797 tokens the surface takes about 1% of a 200,000-token context window, and it takes it on every turn — this is rent, not a one-off cost. That averages 200 tokens per tool definition, counted with the o200k_base encoding.
That lands exactly on the Developer Tools median of 2,797 tokens.
Every finding below names the rule behind it and the tool it fired on.
The largest group is `schemas/param-desc-missing`, with 18 findings. Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes. On this surface it fires on `read_file`, `read_text_file` and `read_media_file`, among 9 others.
4 findings come from `design/list-no-limit`. A list/search tool with no limit or pagination parameter can dump an unbounded payload into the context window. The caller must be able to ask for less. On this surface it fires on `list_directory`, `list_directory_with_sizes` and `search_files`, among 1 others.
`design/overlap-cluster` contributes one finding. Tools whose descriptions substantially overlap force the model to pick between near-synonyms — the classic cause of wrong-tool calls. Clusters are usually one tool wearing several names; consolidate with include-flags or a mode parameter. It applies to the surface as a whole rather than to one tool.
Filesystem's surface raises one further rule — `schemas/loose` — listed in full below.
Findings that measurably degrade tool selection.
A list/search tool with no limit or pagination parameter can dump an unbounded payload into the context window. The caller must be able to ask for less.
A list/search tool with no limit or pagination parameter can dump an unbounded payload into the context window. The caller must be able to ask for less.
A list/search tool with no limit or pagination parameter can dump an unbounded payload into the context window. The caller must be able to ask for less.
A list/search tool with no limit or pagination parameter can dump an unbounded payload into the context window. The caller must be able to ask for less.
Tools whose descriptions substantially overlap force the model to pick between near-synonyms — the classic cause of wrong-tool calls. Clusters are usually one tool wearing several names; consolidate with include-flags or a mode parameter.
list_directory, list_directory_with_sizes
Loose schemas (bare objects, untyped arrays, open additionalProperties) turn schema validation off exactly where the model is most likely to hallucinate argument shapes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
Undescribed parameters get filled by guesswork. Every property the model must populate deserves a sentence saying what it means and what shape it takes.
4 of the six categories come through clean: surface, naming, descriptions and annotations. In practice that means the surface stays inside a sensible tool and token budget, the tool names follow one convention end to end, every tool carries a description long enough to disambiguate it and read and write operations are machine-distinguishable before a client runs them.
`read_media_file` is the most expensive definition at 288 tokens — about 10% of the whole surface — against 147 for `list_allowed_directories`. Every tool carries a description, ranging from 85 to 457 characters.
All 14 declare annotations, so a client can tell a read from a write before running one. Input schemas average 2 top-level parameters and nest 3 levels deep at their worst, with 1 tool taking no input at all.
All 14 tools as published, heaviest first. Token counts use the o200k_base encoding and are approximate.
| Tool | Tokens | Description | Params | Required | Depth | Annotations |
|---|---|---|---|---|---|---|
read_media_file | 288 | 234 chars | 1 | 1 | 1 | yes |
read_text_file | 254 | 457 chars | 3 | 1 | 1 | yes |
edit_file | 243 | 185 chars | 3 | 2 | 3 | yes |
search_files | 217 | 424 chars | 3 | 2 | 2 | yes |
read_multiple_files | 209 | 324 chars | 1 | 1 | 2 | yes |
directory_tree | 200 | 360 chars | 2 | 1 | 2 | yes |
list_directory_with_sizes | 199 | 323 chars | 2 | 1 | 1 | yes |
move_file | 190 | 325 chars | 2 | 2 | 1 | yes |
read_file | 177 | 85 chars | 3 | 1 | 1 | yes |
create_directory | 175 | 310 chars | 1 | 1 | 1 | yes |
write_file | 172 | 228 chars | 2 | 2 | 1 | yes |
list_directory | 164 | 309 chars | 1 | 1 | 1 | yes |
get_file_info | 160 | 296 chars | 1 | 1 | 1 | yes |
list_allowed_directories | 147 | 248 chars | 0 | 0 | 0 | yes |
Filesystem ranks 3 of 5 scanned Developer Tools servers, exactly on the category median of 96.
The closest comparisons in this directory are Playwright, Chrome DevTools and Context7, which sit nearest on score and face the same kind of surface-design pressure.
A fix plan turns these findings into an ordered set of changes with the token saving of each one.
This page is a static analysis of Filesystem's published tools/list surface on the date shown. It is not a security review, a performance benchmark, or a judgement of the product behind the surface. Read how the score is computed, or browse every audited server.