com.files/python-mcp
PYPI · FILES-COM-MCP
Local-only Python MCP server for the Files.com API.
Available components
Last scanned (54 minutes ago)
Scores higher than 61% of PyPI servers
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security40
- Malware scan not yet available for this package.Unverified
- CVE check failed: a known medium-severity CVE affects fastmcp-slim 3.4.7, a direct dependency. A fixed version is available. View diagnostics → Fail
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 4 of 61 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability61
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 11252 tokens (~167/item across 67 items; 67 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage94
- 90% of tools have a non-trivial description (not blank, and not just the tool's name).Partial
- 99% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 67 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Package version: 2.0.0 → 2.0.3 functional
- Package version: 2.0.0 → 2.0.2 functional
- Package version: 2.0.0 → 2.0.1 functional
- 4 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- Schema quality: 149 → 167 ▼ functional
- Package version: 1.0.107 → 2.0.0 functional
- 3 Nov 26 0
- Package version: 1.0.106 → 1.0.107 functional
- 2 Nov 26 0
- Package version: 1.0.101 → 1.0.106 functional
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.0.101 → 1.0.105 functional
- 30 Oct 26 0
- Stability: 0.97 → pass security
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/files-com-mcp@2.0.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-7xgj-8392-5q4r | medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 61 packages
| Packages resolved | 61 |
|---|---|
| Stale | 3 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
List_Remote_Server List Remote Server ~169
List Remote Servers
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| per_page | – | – | Number of records to show per page. (Max: 10000, 1,000 or less is recommended). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
List_Scim_Log List Scim Log ~203
List Scim Logs
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| per_page | – | – | Number of records to show per page. (Max: 10000, 1,000 or less is recommended). |
| sort_by | – | – | If set, sort records by the specified field in either `asc` or `desc` direction. Valid fields are `created_at`. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
List_Settings_Change List Settings Change ~244
List Settings Changes
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| filter | – | – | If set, return records where the specified field is equal to the supplied value. Valid fields are `api_key_id` and `user_id`. |
| per_page | – | – | Number of records to show per page. (Max: 10000, 1,000 or less is recommended). |
| sort_by | – | – | If set, sort records by the specified field in either `asc` or `desc` direction. Valid fields are `created_at`, `api_key_id` or `user_id`. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
List_Sftp_Action_Log List Sftp Action Log ~388
List SFTP Action Logs
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| filter | – | – | If set, return records where the specified field is equal to the supplied value. Valid fields are `path`, `true_path`, `remote_ip`, `session_uuid`, `success`, `status`, `action_type`, `username` or `… |
| filter_gt | – | – | If set, return records where the specified field is greater than the supplied value. Valid fields are `created_at`. |
| filter_gteq | – | – | If set, return records where the specified field is greater than or equal the supplied value. Valid fields are `created_at`. |
| filter_lt | – | – | If set, return records where the specified field is less than the supplied value. Valid fields are `created_at`. |
| filter_lteq | – | – | If set, return records where the specified field is less than or equal the supplied value. Valid fields are `created_at`. |
| filter_prefix | – | – | If set, return records where the specified field is prefixed by the supplied value. Valid fields are `path`, `true_path`, `action_type` or `username`. |
| per_page | – | – | Number of records to show per page. (Max: 1000, 1,000 or less is recommended). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
List_Sync_Log List Sync Log ~337
List Sync Logs
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| filter | – | – | If set, return records where the specified field is equal to the supplied value. Valid fields are `external_event_id`, `operation`, `status`, `sync_id`, `created_at` or `sync_run_id`. |
| filter_gt | – | – | If set, return records where the specified field is greater than the supplied value. Valid fields are `created_at`. |
| filter_gteq | – | – | If set, return records where the specified field is greater than or equal the supplied value. Valid fields are `created_at`. |
| filter_lt | – | – | If set, return records where the specified field is less than the supplied value. Valid fields are `created_at`. |
| filter_lteq | – | – | If set, return records where the specified field is less than or equal the supplied value. Valid fields are `created_at`. |
| per_page | – | – | Number of records to show per page. (Max: 1000, 1,000 or less is recommended). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
List_User List User ~166
List Users
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| per_page | – | – | Number of records to show per page. (Max: 10000, 1,000 or less is recommended). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
List_Web_Dav_Action_Log List Web Dav Action Log ~385
List WebDAV Action Logs
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | Used for pagination. When a list request has more records available, cursors are provided in the response headers `X-Files-Cursor-Next` and `X-Files-Cursor-Prev`. Send one of those cursor value her… |
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| filter | – | – | If set, return records where the specified field is equal to the supplied value. Valid fields are `path`, `true_path`, `remote_ip`, `success`, `status`, `action_type`, `username` or `created_at`. |
| filter_gt | – | – | If set, return records where the specified field is greater than the supplied value. Valid fields are `created_at`. |
| filter_gteq | – | – | If set, return records where the specified field is greater than or equal the supplied value. Valid fields are `created_at`. |
| filter_lt | – | – | If set, return records where the specified field is less than the supplied value. Valid fields are `created_at`. |
| filter_lteq | – | – | If set, return records where the specified field is less than or equal the supplied value. Valid fields are `created_at`. |
| filter_prefix | – | – | If set, return records where the specified field is prefixed by the supplied value. Valid fields are `path`, `true_path`, `action_type` or `username`. |
| per_page | – | – | Number of records to show per page. (Max: 1000, 1,000 or less is recommended). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Move_File Move File ~30
Move File/Folder
| Name | Type | Req | Description |
|---|---|---|---|
| destination | – | – | Move destination path. |
| path | – | – | Path to operate on. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Transform_File Transform File ~77
Transform a file and save the output to a destination path.
| Name | Type | Req | Description |
|---|---|---|---|
| destination | – | – | Destination file path for the transformed output. |
| path | – | – | Path to operate on. |
| target_format | – | – | Destination format to create. |
| transform_type | – | – | Transform type. Supported values are `image_convert`, `document_convert`, and `files_transform_script_execute`. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Unzip_File Unzip File ~39
Extract a ZIP file to a destination folder.
| Name | Type | Req | Description |
|---|---|---|---|
| destination | – | – | Destination folder path for extracted files. |
| path | – | – | ZIP file path to extract. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Update_Bundle Update Bundle ~58
Update Share Link
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | – | – | Explicit Bundle expiration date/time. If not set, the site-wide expiration setting may apply. |
| id | – | – | Bundle ID. |
| permissions | – | – | Permissions that apply to Folders in this Share Link. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Update_Bundle_Notification Update Bundle Notification ~60
Update Share Link Notification
| Name | Type | Req | Description |
|---|---|---|---|
| id | – | – | Bundle Notification ID. |
| notify_on_registration | – | – | Triggers bundle notification when a registration action occurs for it. |
| notify_on_upload | – | – | Triggers bundle notification when a upload action occurs for it. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Update_Group Update Group ~80
Update Group
| Name | Type | Req | Description |
|---|---|---|---|
| admin_ids | – | – | A list of group admin user ids. If sent as a string, should be comma-delimited. |
| id | – | – | Group ID. |
| name | – | – | Group name. |
| notes | – | – | Group notes. |
| user_ids | – | – | A list of user ids. If sent as a string, should be comma-delimited. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Update_User Update User ~392
Update User
| Name | Type | Req | Description |
|---|---|---|---|
| authentication_method | – | – | How is this user authenticated? |
| company | – | – | User's company |
| dav_permission | – | – | Can the user connect with WebDAV? |
| – | – | User's email. | |
| ftp_permission | – | – | Can the user access with FTP/FTPS? |
| group_ids | – | – | A list of group ids to associate this user with. Comma delimited. |
| id | – | – | User ID. |
| name | – | – | User's full name |
| notes | – | – | Any internal notes on the user |
| password | – | – | User password. |
| require_password_change | – | – | Is a password change required upon next user login? |
| restapi_permission | – | – | Can this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.) |
| s3_compatible_endpoint_permission | – | – | Can the user access the S3-compatible endpoint? Defaults to true. |
| sftp_permission | – | – | Can the user access with SFTP? |
| user_home | – | – | Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP… |
| user_root | – | – | If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP a… |
| username | – | – | User's username |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Upload_File_from_Local Upload File from Local ~63
Upload a file to my Files.com site.
| Name | Type | Req | Description |
|---|---|---|---|
| local_path | string | yes | The full path on my local system of the file to be uploaded. |
| remote_path | string | yes | The full path on my Files.com site for the file to be uploaded to. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Zip_File Zip File ~46
Create a ZIP from one or more paths and save it to a destination path.
| Name | Type | Req | Description |
|---|---|---|---|
| destination | – | – | Destination file path for the ZIP. |
| paths | – | – | Paths to include in the ZIP. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
Zip_List_Contents_File Zip List Contents File ~70
List the contents of a ZIP file.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | – | – | Optional list of attribute names to include as columns in the response table. When omitted, a sensible default set is used. Useful for narrowing wide entities or surfacing fields not in the default. |
| path | – | – | Path to operate on. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
How do I install the com.files/python-mcp server?
com.files/python-mcp runs locally as a PyPI package, launched with uvx files-com-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · files-com-mcp
claude mcp add com-files-python-mcp -- uvx files-com-mcp
What is the com.files/python-mcp server?
com.files/python-mcp is listed in the public MCP registry as com.files/python-mcp. Local-only Python MCP server for the Files.com API. This page covers its PyPI package (files-com-mcp).
Is the com.files/python-mcp server safe to use?
com.files/python-mcp scores 64 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.files/python-mcp server expose?
com.files/python-mcp exposes 67 tools: Download_File_to_Local, Upload_File_from_Local, List_Bundle, Find_Bundle, Create_Bundle, and 62 more. Their descriptions and schemas cost roughly 11,252 tokens of context every time the server is loaded.
Is the com.files/python-mcp server still maintained?
com.files/python-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.files/python-mcp server under?
com.files/python-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.