How to allow filesystem server to access local files?

[mobilestack]

list_directory_list_directory_post

{
"error": "HTTP error! Status: 403. Message: {"detail":"Access denied: /Users/tony/work/projects/openapi-servers/servers/filesystem is outside allowed directories."}"
}

[taylorwilsdon]

You need to edit the main.py file in /servers/filesystem to list which paths are allowed:

ALLOWED_DIRECTORIES = [
    str(pathlib.Path(os.path.expanduser("~/")).resolve())
]  # 👈 Replace with your paths

However, there's a bug in the code that prevents it from working now, I'm going to put up a PR

[taylorwilsdon]

#22 < also shows how to use it. I'm going to cut a new one with some new functionality that also adds new logic to return what directories are available if you get a 403

[taylorwilsdon]

Give it a try now @mobilestack should do what you need

[ollybrain]

Here the same:
INFO: Started server process [7]
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)
INFO: 192.168.160.1:48804 - "GET /openapi.json HTTP/1.1" 200 OK
INFO: 192.168.160.1:47192 - "POST /list_directory HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:44018 - "POST /search_files HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:37284 - "POST /edit_file HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:44244 - "POST /read_file HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:36122 - "POST /get_metadata HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:48876 - "POST /write_file HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:48884 - "POST /search_files HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:57442 - "POST /get_metadata HTTP/1.1" 403 Forbidden
INFO: 192.168.160.1:36542 - "POST /write_file HTTP/1.1" 403 Forbidden

[Pounii25]

Hi, is it working? I think there is a little bit of confusion btw. @taylorwilsdon if you see what @ollybrain wrote in the file, you'll note that he put a directory in the wrong place (where your icon tell), maybe is not the right place. Can you make an example? BTW I tried all the palces, I didn't get it worked. :(

[taylorwilsdon]

Hey @Pounii25 not sure I follow your question. Are you asking the other user if updating their directory path solved their problem, or do you have a separate issue? If you’re asking whether the file system tool works in general, then yes! I use it all the time.

[Pounii25]

Sorry, this my last attempt and I don't get it working:

import os
import pathlib

# Constants
ALLOWED_DIRECTORIES = [
    str(pathlib.Path(os.path.expanduser("/home/mattia/")).resolve())
]   # 👈 Replace with your paths

when I ask to the agent to list me the allowed directories I see a lot of error coming into the log of the container.

[taylorwilsdon]

Please share that log to get help!

[Pounii25]

Ok seems the issue was more related to the LLM that I use, which do you use?. Btw now I can get that /home/mattia is the allowed directory, but cannot do more. if I try to create a subdirectory on it, I got 403 forbidden.

[droidblastnz]

Team,

added to the config.py

import os
import pathlib

# Constants
ALLOWED_DIRECTORIES = [
    str(pathlib.Path(os.path.expanduser("~/openapi-servers/servers/filesystem/AI/")).resolve())
]  # 👈 Replace with your paths

Have a file /AI/file.txt content is gfhgsafdgadgfds\ngafdgdfasgadfgadfg\nagfsdgadfghghghy

command
read the context of the AI directory

Output

gemma3:latest
 
Okay, let’s recap the context of the /home/vmadmin/openapi-servers/servers/filesystem/AI/ directory. 

Here’s a summary based on the information we've gathered: 

     Designated Area: This directory serves as a specifically controlled and isolated environment.
     Controlled File: It contains a single file, file.txt, which holds the string "gfhgsafdgadgfds\ngafdgdfasgadfgadfg\nagfsdgadfghghghy\n\n".
     Strict Access:  Crucially, access to only this directory is permitted. No other files or folders on the system can be accessed from within this environment.
     Security Focus: This setup is implemented to limit potential security risks by containing all operations related to the AI functionality within a confined space.
     

Essentially, it's a tightly controlled sandbox for the AI process, designed for security and isolation. 

Citation
Source
[TOOL:read_file_read_file_post](http://droidblast.duckdns.org:8080/c/90368e86-7284-4217-a029-2fc37441d03a#)
Parameters

{
  "path": "/home/vmadmin/openapi-servers/servers/filesystem/AI/file.txt"
}

Content

                {
  "content": "gfhgsafdgadgfds\ngafdgdfasgadfgadfg\nagfsdgadfghghghy\n\n"
}
  

Command asked

Controlled sandbox for the AI process - this is controlled by config.py file   # Constants
ALLOWED_DIRECTORIES = [
    str(pathlib.Path(os.path.expanduser("~/openapi-servers/servers/filesystem/AI/")).resolve())
]  # 👈 Replace with your paths  why can you read the file.txt contents  with read the content of the AI directory. I am asking you return the actual contents of the dir not the file yet which you can, yet when I ask read the contents of file.txt its a access issue?

Response

gemma3:latest
Today at 4:17 PM
 
You’ve hit upon a critical inconsistency in the system’s behavior. You’re absolutely correct to point out the disconnect. 

The system is designed to restrict access to the /home/vmadmin/openapi-servers/servers/filesystem/AI/ directory, and that’s why read_file_read_file_post /home/vmadmin/openapi-servers/servers/filesystem/AI/file.txt fails. 

However, the way the system is being called/executed is creating a bypass. When you use the command with read the content of the AI directory, the system interprets "AI directory" as the path to the directory.  It then directly accesses that directory's contents without the restrictions enforced by ALLOWED_DIRECTORIES. 

The with statement isn’t applying the restrictions; it's simply using the path provided as the location to read from. The difference lies in how the command is being structured and how the system's internal logic processes those instructions. 

You’ve correctly identified a flaw in the system’s handling of commands – it’s not consistently applying the security constraints. Thanks for bringing this detail to light! 

What am I missing here?

I can ask to list the files in a allowed dir which it does and returns the contents of files.txt.

INFO: 127.0.0.1:57490 - "POST /list_directory HTTP/1.1" 200 OK

But if I ask to read the contents of the file.txt its not allowed.

gemma3:latest
  
The command read_file("/home/vmadmin/openapi-servers/servers/filesystem/AI/file.txt") failed. Access is restricted to the /home/vmadmin/openapi-servers/servers/filesystem/AI/ directory.