Use case · File and MCP access

Give file-touching agents the same floor in shell and MCP

Cover recursive deletion and permission changes no matter whether the agent reaches the filesystem through a shell or through MCP tools.

Agents touch files through two surfaces: shell commands and MCP tool calls. The catalog documents a required shell-side entry for recursive deletion and access-control changes, and an external, opt-in entry that reviews the official filesystem MCP tools — so the second surface only runs after you deliberately enable it.

Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12

Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.

When this is not the right fit

Skip this workflow if

  • The MCP server in use is not the official filesystem MCP — the catalog documents the official filesystem MCP tools entry.
  • You need network or process isolation rather than command review; these entries document command and tool review, not sandboxing.

Prerequisites

Before you start

  • Guard is installed on the machine where the agent runs.
  • For the MCP surface, you are willing to opt in — external coverage stays off until enabled through Guard controls.

Steps

The workflow

  1. 1

    Confirm the shell-side floor

    The filesystem entry reviews recursive deletion and access-control changes across filesystem trees. Its protection model is required, so it is part of Guard’s required protection set where its tools apply and cannot be opted out per workspace.

    Filesystem protectionTry this coverage Coverage details
  2. 2

    Opt in to filesystem MCP review

    The Filesystem MCP entry reviews official filesystem MCP tools. Its protection model is external-opt-in: off until you turn it on through Guard controls, with claim policy provenance and executable npx.

    Filesystem MCPTry this coverage Coverage details
  3. 3

    Verify both surfaces are stated in the catalog

    Read each entry’s stated limitations on its detail page before relying on the combination — the catalog records the same limitation for both: coverage is limited to the reviewed operations and the surrounding Guard policy.

    Filesystem protectionTry this coverage Coverage details

Expected result

What the documented coverage should do

Recursive deletes and permission changes from the shell are reviewed by the required floor, and — after a deliberate opt-in — official filesystem MCP tool calls are reviewed through the external entry. Reading these pages never changes a policy.

Limitations

What this workflow does not claim

  • The MCP surface covers the official filesystem MCP tools documented in the catalog, not arbitrary MCP servers.
  • External coverage requires explicit opt-in and records provenance; a maintainer profile is not an upstream endorsement.

Coverage referenced

Extensions in this workflow