@j0hanz/filesystem-mcp 1.9.0 → 1.9.1

package/README.md

@@ -834,7 +834,7 @@ All 18 tools define `outputSchema` (Zod -> JSON Schema) and return `structuredCo
 
 | Variable                           | Default          | Description                                                                    |
 | ---------------------------------- | ---------------- | ------------------------------------------------------------------------------ |
-| `FILESYSTEM_MCP_API_KEY`           | _(none)_         | Optional Bearer token for HTTP transport authentication                        |
+| `FILESYSTEM_MCP_API_KEY`           | _(none)_         | Bearer token required when binding HTTP to a non-loopback host                 |
 | `FILESYSTEM_MCP_MAX_HTTP_SESSIONS` | `100`            | Max concurrent HTTP sessions (1-10,000)                                        |
 | `FILESYSTEM_MCP_HTTP_HOST`         | `127.0.0.1`      | HTTP server bind address                                                       |
 | `FS_CONTEXT_MAX_REQUEST_BYTES`     | `4194304` (4 MB) | Max HTTP request body size (1 KB - 256 MB)                                     |
@@ -858,10 +858,10 @@ When started with `--port <number>`, the server exposes a single MCP endpoint:
 
 **Required headers:**
 
-- `mcp-protocol-version` — must match MCP v2025-11-25
+- `mcp-protocol-version` — use the negotiated MCP protocol version on post-initialize HTTP requests
 - `mcp-session-id` — required for `GET`/`DELETE` (returned by `POST` on initialize)
 
-**Authentication:** If `FILESYSTEM_MCP_API_KEY` is set, requests must include `Authorization: Bearer <key>`. Uses SHA-256 timing-safe comparison.
+**Authentication:** Requests to non-loopback HTTP binds require `FILESYSTEM_MCP_API_KEY`; clients must then send `Authorization: Bearer <key>`. Loopback-only binds may omit auth for local use. Uses SHA-256 timing-safe comparison.
 
 **CORS:** Only localhost origins allowed (`127.0.0.1`, `::1`, `localhost`).
 
@@ -873,11 +873,11 @@ When started with `--port <number>`, the server exposes a single MCP endpoint:
 | Traversal prevention      | confirmed | `src/lib/paths.ts` — resolved paths checked after normalization                        |
 | Symlink escape prevention | confirmed | `src/__tests__/security.test.ts` — symlink boundary enforcement                        |
 | Sensitive file denylist   | confirmed | `src/lib/constants.ts` — blocks `.git`, `.env*`, SSH keys, certs, secrets              |
-| Origin validation         | confirmed | `src/server/bootstrap.ts` — localhost-only CORS regex                                  |
+| Origin validation         | confirmed | `src/server/bootstrap.ts` — localhost-only Origin allowlist                            |
 | Bearer auth               | confirmed | `src/server/bootstrap.ts` — optional `FILESYSTEM_MCP_API_KEY` with timing-safe compare |
 | Input validation          | confirmed | `src/schemas.ts` — Zod strict schemas on all tool inputs                               |
 | Request body limit        | confirmed | `src/server/bootstrap.ts` — configurable max request size (413 on overflow)            |
-| DNS rebinding protection  | confirmed | `src/server/bootstrap.ts` — Host header validation                                     |
+| Remote bind guard         | confirmed | `src/server/bootstrap.ts` — refuses non-loopback bind without `FILESYSTEM_MCP_API_KEY` |
 
 ## Development
 

package/dist/lib/file-operations/search.d.ts

@@ -19,12 +19,12 @@ declare const SearchOptionsSchema: z.ZodObject<{
     filePattern: z.ZodString;
     excludePatterns: z.ZodArray<z.ZodString>;
     caseSensitive: z.ZodBoolean;
-    maxResults: z.ZodNumber;
-    maxFileSize: z.ZodNumber;
-    maxFilesScanned: z.ZodNumber;
-    timeoutMs: z.ZodNumber;
+    maxResults: z.ZodInt;
+    maxFileSize: z.ZodInt;
+    maxFilesScanned: z.ZodInt;
+    timeoutMs: z.ZodInt;
     skipBinary: z.ZodBoolean;
-    contextLines: z.ZodNumber;
+    contextLines: z.ZodInt;
     wholeWord: z.ZodBoolean;
     isLiteral: z.ZodBoolean;
     includeHidden: z.ZodBoolean;

package/dist/lib/file-operations/search.js

@@ -88,12 +88,12 @@ const SearchOptionsSchema = z.strictObject({
     filePattern: z.string().min(1),
     excludePatterns: z.array(z.string()),
     caseSensitive: z.boolean(),
-    maxResults: z.number().int().nonnegative(),
-    maxFileSize: z.number().int().nonnegative(),
-    maxFilesScanned: z.number().int().nonnegative(),
-    timeoutMs: z.number().int().nonnegative(),
+    maxResults: z.int().min(0),
+    maxFileSize: z.int().min(0),
+    maxFilesScanned: z.int().min(0),
+    timeoutMs: z.int().min(0),
     skipBinary: z.boolean(),
-    contextLines: z.number().int().nonnegative(),
+    contextLines: z.int().min(0),
     wholeWord: z.boolean(),
     isLiteral: z.boolean(),
     includeHidden: z.boolean(),

package/dist/lib/paths.d.ts

@@ -3,6 +3,10 @@ import { McpError } from './errors.js';
 export declare function toPosixPath(value: string): string;
 export declare function isSensitivePath(requestedPath: string, resolvedPath?: string): boolean;
 export declare function assertAllowedFileAccess(requestedPath: string, resolvedPath?: string): void;
+export interface AllowedDirectoriesState {
+    primary: string[];
+    expanded: string[];
+}
 /**
  * Normalizes any path-like input to an absolute path suitable for comparisons.
  * - Expands "~" home directory shorthand.
@@ -10,9 +14,13 @@ export declare function assertAllowedFileAccess(requestedPath: string, resolvedP
  * - Lowercases Windows drive letter for stable comparisons.
  */
 export declare function normalizePath(p: string): string;
+export declare function withAllowedDirectoriesState<T>(state: AllowedDirectoriesState, run: () => T): T;
+export declare function getAllowedDirectoriesState(): AllowedDirectoriesState;
+export declare function setAllowedDirectoriesStateResolved(state: AllowedDirectoriesState): void;
 export declare function getAllowedDirectories(): string[];
 export declare function isAllowedDirectoryRoot(normalizedPath: string): boolean;
 export declare function isPathWithinDirectories(normalizedPath: string, allowedDirs: readonly string[]): boolean;
+export declare function resolveAllowedDirectoriesState(dirs: readonly string[], signal?: AbortSignal): Promise<AllowedDirectoriesState>;
 export declare function setAllowedDirectoriesResolved(dirs: readonly string[], signal?: AbortSignal): Promise<void>;
 export declare function getReservedDeviceNameForPath(requestedPath: string): string | undefined;
 export declare function isWindowsDriveRelativePath(requestedPath: string): boolean;

package/dist/lib/paths.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs/promises';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { platform } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { SENSITIVE_FILE_ALLOWLIST, SENSITIVE_FILE_DENYLIST, } from './constants.js';
@@ -137,9 +138,18 @@ const RESERVED_DEVICE_NAMES = new Set([
     'LPT8',
     'LPT9',
 ]);
+const allowedDirectoriesContext = new AsyncLocalStorage({
+    name: 'filesystem-mcp:allowed-directories',
+});
 function dedupePreserveOrder(items) {
     return [...new Set(items)];
 }
+function cloneAllowedDirectoriesState(state) {
+    return {
+        primary: [...state.primary],
+        expanded: [...state.expanded],
+    };
+}
 function expandHome(filepath) {
     if (filepath === '~')
         return HOMEDIR;
@@ -218,26 +228,41 @@ function normalizeAllowedDirectories(dirs) {
 // single MCP session per process, so this is safe. In HTTP mode all HTTP
 // sessions within the same process share one policy — multi-tenant isolation
 // (different roots per session) requires separate server processes.
-let allowedDirectoriesExpanded = [];
-let allowedDirectoriesPrimary = [];
+let defaultAllowedDirectoriesState = {
+    primary: [],
+    expanded: [],
+};
 function setAllowedDirectoriesState(primary, expanded) {
-    allowedDirectoriesPrimary = dedupePreserveOrder(primary);
-    allowedDirectoriesExpanded = dedupePreserveOrder(expanded);
+    defaultAllowedDirectoriesState = {
+        primary: dedupePreserveOrder(primary),
+        expanded: dedupePreserveOrder(expanded),
+    };
+}
+function getActiveAllowedDirectoriesState() {
+    return allowedDirectoriesContext.getStore() ?? defaultAllowedDirectoriesState;
+}
+export function withAllowedDirectoriesState(state, run) {
+    return allowedDirectoriesContext.run(cloneAllowedDirectoriesState(state), run);
+}
+export function getAllowedDirectoriesState() {
+    return cloneAllowedDirectoriesState(getActiveAllowedDirectoriesState());
+}
+export function setAllowedDirectoriesStateResolved(state) {
+    setAllowedDirectoriesState(state.primary, state.expanded);
 }
 export function getAllowedDirectories() {
-    return [...allowedDirectoriesExpanded];
+    return [...getActiveAllowedDirectoriesState().expanded];
 }
 export function isAllowedDirectoryRoot(normalizedPath) {
-    for (const dir of allowedDirectoriesExpanded) {
+    for (const dir of getActiveAllowedDirectoriesState().expanded) {
         if (isSamePath(normalizedPath, dir))
             return true;
     }
     return false;
 }
 function getAllowedDirectoriesForRelativeResolution() {
-    return allowedDirectoriesPrimary.length > 0
-        ? allowedDirectoriesPrimary
-        : allowedDirectoriesExpanded;
+    const state = getActiveAllowedDirectoriesState();
+    return state.primary.length > 0 ? state.primary : state.expanded;
 }
 function isPathInsideDirectory(normalizedDirectory, normalizedCandidate) {
     const root = normalizeForComparison(normalizedDirectory);
@@ -286,10 +311,14 @@ async function expandAllowedDirectories(primaryDirs, signal) {
     }
     return dedupePreserveOrder(expanded);
 }
-export async function setAllowedDirectoriesResolved(dirs, signal) {
+export async function resolveAllowedDirectoriesState(dirs, signal) {
     const primary = normalizeAllowedDirectories(dirs);
     const expanded = await expandAllowedDirectories(primary, signal);
-    setAllowedDirectoriesState(primary, expanded);
+    return { primary, expanded };
+}
+export async function setAllowedDirectoriesResolved(dirs, signal) {
+    const state = await resolveAllowedDirectoriesState(dirs, signal);
+    setAllowedDirectoriesStateResolved(state);
 }
 function ensureNonEmptyPath(requestedPath) {
     if (!requestedPath || requestedPath.trim().length === 0) {

package/dist/schemas.d.ts

@@ -34,13 +34,13 @@ export declare const ToolErrorResponseSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 declare const HeadLinesSchema: z.ZodOptional<z.ZodInt>;
-declare const LineNumberSchema: z.ZodNumber;
+declare const LineNumberSchema: z.ZodInt;
 export declare const ListDirectoryInputSchema: z.ZodObject<{
     path: z.ZodOptional<z.ZodString>;
     includeHidden: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     includeIgnored: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-    maxDepth: z.ZodOptional<z.ZodNumber>;
-    maxEntries: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    maxDepth: z.ZodOptional<z.ZodInt>;
+    maxEntries: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
     sortBy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
         name: "name";
         size: "size";
@@ -55,7 +55,7 @@ export declare const ListAllowedDirectoriesInputSchema: z.ZodObject<{}, z.core.$
 export declare const SearchFilesInputSchema: z.ZodObject<{
     path: z.ZodOptional<z.ZodString>;
     pattern: z.ZodString;
-    maxResults: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    maxResults: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
     includeIgnored: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     includeHidden: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     sortBy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
@@ -64,13 +64,13 @@ export declare const SearchFilesInputSchema: z.ZodObject<{
         path: "path";
         modified: "modified";
     }>>>;
-    maxDepth: z.ZodOptional<z.ZodNumber>;
+    maxDepth: z.ZodOptional<z.ZodInt>;
     cursor: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const TreeInputSchema: z.ZodObject<{
     path: z.ZodOptional<z.ZodString>;
-    maxDepth: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    maxEntries: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    maxDepth: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
+    maxEntries: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
     includeHidden: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     includeIgnored: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strict>;
@@ -80,8 +80,8 @@ export declare const SearchContentInputSchema: z.ZodObject<{
     isRegex: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     caseSensitive: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     wholeWord: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-    contextLines: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    maxResults: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    contextLines: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
+    maxResults: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
     filePattern: z.ZodDefault<z.ZodOptional<z.ZodString>>;
     includeHidden: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     includeIgnored: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -658,7 +658,7 @@ export declare const CalculateHashOutputSchema: z.ZodObject<{
 export declare const DiffFilesInputSchema: z.ZodObject<{
     original: z.ZodString;
     modified: z.ZodString;
-    context: z.ZodOptional<z.ZodNumber>;
+    context: z.ZodOptional<z.ZodInt>;
     ignoreWhitespace: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     stripTrailingCr: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strict>;
@@ -691,7 +691,7 @@ export declare const DiffFilesOutputSchema: z.ZodObject<{
 export declare const ApplyPatchInputSchema: z.ZodObject<{
     path: z.ZodString;
     patch: z.ZodString;
-    fuzzFactor: z.ZodOptional<z.ZodNumber>;
+    fuzzFactor: z.ZodOptional<z.ZodInt>;
     autoConvertLineEndings: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strict>;

package/dist/schemas.js

@@ -57,10 +57,7 @@ const HeadLinesSchema = z
     .max(100000, 'Max: 100,000')
     .optional()
     .describe('Read first N lines');
-const LineNumberSchema = z
-    .number()
-    .int({ error: 'Must be integer' })
-    .min(1, 'Min: 1');
+const LineNumberSchema = z.int({ error: 'Must be integer' }).min(1, 'Min: 1');
 function addReadRangeIssue(ctx, path, message) {
     ctx.addIssue({
         code: 'custom',
@@ -115,14 +112,12 @@ export const ListDirectoryInputSchema = z.strictObject({
     includeHidden: defaultFalseBoolean('Include hidden items (starting with .)'),
     includeIgnored: defaultFalseBoolean('Include ignored items (node_modules, .git, etc).'),
     maxDepth: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(1, 'Min: 1')
         .max(MAX_TREE_DEPTH, `Max: ${MAX_TREE_DEPTH}`)
         .optional()
         .describe('Max recursion depth when pattern is provided'),
     maxEntries: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(1, 'Min: 1')
         .max(MAX_LIST_ENTRIES, `Max: ${MAX_LIST_ENTRIES}`)
@@ -158,7 +153,6 @@ export const SearchFilesInputSchema = z.strictObject({
     })
         .describe('Glob pattern (e.g. "**/*.ts", "src/*.js")'),
     maxResults: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(1, 'Min: 1')
         .max(MAX_SEARCH_RESULTS, `Max: ${MAX_SEARCH_RESULTS}`)
@@ -171,7 +165,6 @@ export const SearchFilesInputSchema = z.strictObject({
         .default('path')
         .describe('Sort by path, name, size, or modified'),
     maxDepth: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(0, 'Min: 0')
         .max(MAX_SEARCH_DEPTH, `Max: ${MAX_SEARCH_DEPTH}`)
@@ -185,7 +178,6 @@ export const SearchFilesInputSchema = z.strictObject({
 export const TreeInputSchema = z.strictObject({
     path: OptionalPathSchema.describe(DESC_PATH_ROOT),
     maxDepth: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(0, 'Min: 0')
         .max(MAX_TREE_DEPTH, `Max: ${MAX_TREE_DEPTH}`)
@@ -193,7 +185,6 @@ export const TreeInputSchema = z.strictObject({
         .default(DEFAULT_TREE_DEPTH)
         .describe(`Depth (0=root node only, no children). Default: ${DEFAULT_TREE_DEPTH}`),
     maxEntries: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(1, 'Min: 1')
         .max(MAX_TREE_ENTRIES, `Max: ${MAX_TREE_ENTRIES}`)
@@ -214,7 +205,6 @@ export const SearchContentInputSchema = z.strictObject({
     caseSensitive: defaultFalseBoolean('Case-sensitive matching. Default: case-insensitive.'),
     wholeWord: defaultFalseBoolean('Match whole words only'),
     contextLines: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(0, 'Min: 0')
         .max(50, 'Max: 50')
@@ -222,7 +212,6 @@ export const SearchContentInputSchema = z.strictObject({
         .default(0)
         .describe('Include N lines of context before/after matches'),
     maxResults: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(0, 'Min: 0')
         .max(MAX_SEARCH_RESULTS, `Max: ${MAX_SEARCH_RESULTS}`)
@@ -434,7 +423,7 @@ export const CreateDirectoryInputSchema = z
         .describe('Absolute paths to directories to create'),
 })
     .refine((data) => data.path !== undefined || data.paths !== undefined, {
-    message: "Either 'path' or 'paths' must be provided",
+    error: "Either 'path' or 'paths' must be provided",
     path: ['path'],
 });
 export const CreateDirectoryOutputSchema = z.strictObject({
@@ -490,7 +479,7 @@ export const MoveFileInputSchema = z
     destination: RequiredPathSchema.describe('New path'),
 })
     .refine((data) => (data.source ?? data.sources) !== undefined, {
-    message: "Either 'source' or 'sources' must be provided",
+    error: "Either 'source' or 'sources' must be provided",
     path: ['source'],
 });
 export const MoveFileOutputSchema = z.strictObject({
@@ -535,7 +524,6 @@ export const DiffFilesInputSchema = z.strictObject({
     original: RequiredPathSchema.describe('Path to original file'),
     modified: RequiredPathSchema.describe('Path to modified file'),
     context: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(0, 'Min: 0')
         .max(10000, 'Max: 10,000')
@@ -566,7 +554,6 @@ export const ApplyPatchInputSchema = z.strictObject({
         .string()
         .describe('Unified diff with @@ hunk headers. Generate with `diff_files`.'),
     fuzzFactor: z
-        .number()
         .int({ error: 'Must be integer' })
         .min(0, 'Min: 0')
         .max(20, 'Max: 20')

package/dist/server/bootstrap.js

@@ -6,8 +6,9 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { isInitializeRequest, SetLevelRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { DEFAULT_LOG_LEVEL, parseEnvInt, REQUIRED_MCP_PROTOCOL_VERSION, } from '../lib/constants.js';
+import { DEFAULT_LOG_LEVEL, parseEnvInt } from '../lib/constants.js';
 import { formatUnknownErrorMessage } from '../lib/errors.js';
+import { withAllowedDirectoriesState } from '../lib/paths.js';
 import { createInMemoryResourceStore } from '../lib/resource-store.js';
 import { isRecord } from '../lib/utils.js';
 import { registerCompletions } from '../completions.js';
@@ -249,7 +250,7 @@ async function createHttpSession(options, sessions) {
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (sessionId) => {
-            sessions.set(sessionId, { server: mcpServer, transport });
+            sessions.set(sessionId, { server: mcpServer, rootsManager, transport });
             rootsManager.logMissingDirectoriesIfNeeded(mcpServer);
         },
     });
@@ -264,7 +265,7 @@ async function createHttpSession(options, sessions) {
         });
     };
     await mcpServer.connect(transport);
-    return { server: mcpServer, transport };
+    return { server: mcpServer, rootsManager, transport };
 }
 function sendJsonRpcError(res, status, code, message) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
@@ -280,32 +281,33 @@ function isAllowedOrigin(origin) {
         return true; // Non-browser clients omit Origin.
     return LOCALHOST_ORIGIN_RE.test(origin);
 }
-function getProtocolVersionHeader(req) {
-    const rawProtocolVersion = req.headers['mcp-protocol-version'];
-    if (typeof rawProtocolVersion === 'string') {
-        return rawProtocolVersion;
-    }
-    if (Array.isArray(rawProtocolVersion)) {
-        return rawProtocolVersion.find((value) => value === REQUIRED_MCP_PROTOCOL_VERSION);
-    }
-    return undefined;
-}
-function ensureProtocolVersionHeader(req, res) {
-    const protocolVersion = getProtocolVersionHeader(req);
-    if (protocolVersion === REQUIRED_MCP_PROTOCOL_VERSION) {
-        return true;
-    }
-    sendJsonRpcError(res, 400, -32000, 'Bad Request: MCP-Protocol-Version header missing or unsupported');
-    return false;
-}
 function discardRequestBody(req) {
     req.on('error', () => {
         // Best effort drain to avoid corrupting keep-alive pipelines.
     });
     req.resume();
 }
+async function handleSessionTransportRequest(session, req, res, body) {
+    await withAllowedDirectoriesState(session.rootsManager.getAllowedDirectoriesState(), () => session.transport.handleRequest(req, res, body));
+}
+function isLoopbackHttpHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return (normalized === '127.0.0.1' ||
+        normalized === 'localhost' ||
+        normalized === '::1' ||
+        normalized === '[::1]');
+}
+function assertHttpBindingSecurity(host) {
+    if (isLoopbackHttpHost(host))
+        return;
+    if (process.env['FILESYSTEM_MCP_API_KEY'])
+        return;
+    throw new Error(`Refusing to bind HTTP server to non-loopback host '${host}' without FILESYSTEM_MCP_API_KEY.`);
+}
 export async function startHttpServer(port, options) {
     const sessions = new Map();
+    const httpHost = process.env['FILESYSTEM_MCP_HTTP_HOST'] ?? '127.0.0.1';
+    assertHttpBindingSecurity(httpHost);
     async function handleMcpRequest(req, res) {
         const { method } = req;
         const MAX_SESSION_ID_LENGTH = 256;
@@ -354,14 +356,10 @@ export async function startHttpServer(port, options) {
                         discardRequestBody(req);
                         return;
                     }
-                    if (!ensureProtocolVersionHeader(req, res)) {
-                        discardRequestBody(req);
-                        return;
-                    }
                     const body = await readRequestBody(req);
                     const session = sessions.get(sessionId);
                     if (session) {
-                        await session.transport.handleRequest(req, res, body);
+                        await handleSessionTransportRequest(session, req, res, body);
                     }
                     else {
                         sendJsonRpcError(res, 404, -32000, 'Session not found');
@@ -375,8 +373,8 @@ export async function startHttpServer(port, options) {
                         sendJsonRpcError(res, 503, -32000, 'Too many sessions');
                         return;
                     }
-                    const { transport } = await createHttpSession(options, sessions);
-                    await transport.handleRequest(req, res, body);
+                    const session = await createHttpSession(options, sessions);
+                    await handleSessionTransportRequest(session, req, res, body);
                     return;
                 }
                 sendJsonRpcError(res, 400, -32000, 'Bad Request: No valid session ID provided');
@@ -391,12 +389,9 @@ export async function startHttpServer(port, options) {
                     sendJsonRpcError(res, 404, -32000, 'Session not found');
                     return;
                 }
-                if (!ensureProtocolVersionHeader(req, res)) {
-                    return;
-                }
                 const session = sessions.get(sessionId);
                 if (session) {
-                    await session.transport.handleRequest(req, res);
+                    await handleSessionTransportRequest(session, req, res);
                 }
                 else {
                     sendJsonRpcError(res, 404, -32000, 'Session not found');
@@ -439,9 +434,6 @@ export async function startHttpServer(port, options) {
             res.end('Not Found');
         }
     });
-    // Default to localhost-only binding to prevent DNS-rebinding and unintended
-    // external exposure. Override with FILESYSTEM_MCP_HTTP_HOST for remote setups.
-    const httpHost = process.env['FILESYSTEM_MCP_HTTP_HOST'] ?? '127.0.0.1';
     return new Promise((resolve, reject) => {
         httpServer.once('error', reject);
         httpServer.listen(port, httpHost, () => {

package/dist/server/roots-manager.d.ts

@@ -1,9 +1,11 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type AllowedDirectoriesState } from '../lib/paths.js';
 import { type LoggingState } from './bootstrap.js';
 import type { ServerOptions } from './bootstrap.js';
 export declare class RootsManager {
     private rootsUpdateTimeout;
     private rootDirectories;
+    private allowedDirectoriesState;
     private clientInitialized;
     private updatingRoots;
     private pendingRootsUpdate;
@@ -12,6 +14,7 @@ export declare class RootsManager {
     constructor(options: ServerOptions, loggingState: LoggingState);
     isInitialized(): boolean;
     destroy(): void;
+    getAllowedDirectoriesState(): AllowedDirectoriesState;
     logMissingDirectoriesIfNeeded(server: McpServer): void;
     registerHandlers(server: McpServer): void;
     recomputeAllowedDirectories(): Promise<void>;

package/dist/server/roots-manager.js

@@ -3,7 +3,7 @@ import { InitializedNotificationSchema, RootsListChangedNotificationSchema, } fr
 import { z } from 'zod';
 import { formatUnknownErrorMessage } from '../lib/errors.js';
 import { assertNotAborted, createTimedAbortSignal, withAbort, } from '../lib/fs-helpers.js';
-import { getAllowedDirectories, getValidRootDirectories, isPathWithinDirectories, normalizePath, setAllowedDirectoriesResolved, } from '../lib/paths.js';
+import { getValidRootDirectories, isPathWithinDirectories, normalizePath, resolveAllowedDirectoriesState, setAllowedDirectoriesStateResolved, } from '../lib/paths.js';
 import { isRecord } from '../lib/utils.js';
 import { logToMcp } from './bootstrap.js';
 const ROOTS_TIMEOUT_MS = 5000;
@@ -83,6 +83,10 @@ async function filterRootsWithinBaseline(roots, baseline, signal) {
 export class RootsManager {
     rootsUpdateTimeout;
     rootDirectories = [];
+    allowedDirectoriesState = {
+        primary: [],
+        expanded: [],
+    };
     clientInitialized = false;
     // Set to true when an update is in progress, to prevent concurrent executions. If a change arrives while true, we queue a single retry after completion to ensure the last-known state is applied. This
     updatingRoots = false;
@@ -103,8 +107,14 @@ export class RootsManager {
             this.rootsUpdateTimeout = undefined;
         }
     }
+    getAllowedDirectoriesState() {
+        return {
+            primary: [...this.allowedDirectoriesState.primary],
+            expanded: [...this.allowedDirectoriesState.expanded],
+        };
+    }
     logMissingDirectoriesIfNeeded(server) {
-        if (getAllowedDirectories().length === 0) {
+        if (this.allowedDirectoriesState.expanded.length === 0) {
             this.logMissingDirectories(server);
         }
     }
@@ -130,7 +140,9 @@ export class RootsManager {
                 ? await filterRootsWithinBaseline(this.rootDirectories, baseline, signal)
                 : this.rootDirectories;
             const combined = [...baseline, ...rootsToInclude];
-            await setAllowedDirectoriesResolved(combined, signal);
+            const nextState = await resolveAllowedDirectoriesState(combined, signal);
+            this.allowedDirectoriesState = nextState;
+            setAllowedDirectoriesStateResolved(nextState);
         }
         finally {
             cleanup();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@j0hanz/filesystem-mcp",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "mcpName": "io.github.j0hanz/filesystem-mcp",
   "description": "MCP Server that enables LLMs to interact with the local filesystem.",
   "type": "module",