Filesystem Tool
Coding and RAG agents need files. An unbounded fs tool will read .env and write /etc.
A locked office drawer, not the building master key.
Visual Workflows
Start here — scroll inside each diagram frame to explore, then use + / − to zoom up to 200% if needed.
Overview
Scroll inside the frame to explore · use + / − to zoom up to 200%
Scroll inside the frame to explore · use + / − to zoom up to 200%
Resolve then open
Scroll inside the frame to explore · use + / − to zoom up to 200%
Join to root, resolve, reject if it leaves the root.
Key Takeaways
- 1.A filesystem tool reads and writes files the agent is allowed to touch. Root the tool at a project folder — never the whole disk.
- 2.Separate read vs write vs delete permissions. Log every path; block .. and symlinks that escape the root.
- 3.Chroot mentally: all paths relative to a workspace. Resolve and verify the prefix. .env and key files denylisted.
- 4.Writes are a permission. Deletes are HITL.
Learn elsewhere
- →Tool Permissions
- →MCP filesystem servers — Phase 8
Real Example
Scenario
Agent may read src/** and write to tmp/patches/. It cannot read ~/.ssh or ../../../etc/passwd.
What you would do
In Tool Calling & Function Calling, apply Filesystem Tool to this scenario: Agent may read src/** and write to tmp/patches/. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.
Commands
Commands to Remember
Root to a folderResolve + prefix checkDenylist secretsDelete is HITL
Cheat Sheet
Quick recap
quick ref- •Locked drawer
- •No disk-wide access
- •Read ≠ write ≠ delete
- •Log paths
Common Mistakes
- ✕Passing user paths to open() with no root
- ✕Allowing delete without HITL
- ✕Reading .env because 'the agent needed config'