Skip to content

fix(filesystem): reject move_file when destination exists - #4668

Open
re2zero wants to merge 1 commit into
modelcontextprotocol:mainfrom
re2zero:fix/move-file-destination-check
Open

fix(filesystem): reject move_file when destination exists#4668
re2zero wants to merge 1 commit into
modelcontextprotocol:mainfrom
re2zero:fix/move-file-destination-check

Conversation

@re2zero

@re2zero re2zero commented Aug 19, 2026

Copy link
Copy Markdown

Closes #4628

Problem

move_file silently overwrites an existing destination file even though the README and the tool description both state it will fail if the destination exists. This is a data-loss bug: an agent that trusts the documented safety contract can destroy files.

Fix

Add an existence check via fs.stat before fs.rename. If the destination already exists, an error is thrown immediately, matching the documented contract.

try {
  await fs.stat(validDestPath);
  throw new Error(`Destination already exists: ${args.destination}`);
} catch (err: any) {
  if (err instanceof Error && err.message.startsWith("Destination already exists")) {
    throw err;
  }
  if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
    throw err;
  }
}
await fs.rename(validSourcePath, validDestPath);

Testing

  • server-filesystem test suite: 152 passed (7 test files).

The move_file tool's documentation states it fails if the destination exists,
but the implementation used fs.rename directly without checking, silently
overwriting the destination.

Add an existence check via fs.stat before the rename, matching the documented
behavior. If the destination exists, throw an error immediately.

Fixes modelcontextprotocol#4628
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

server-filesystem: move_file silently overwrites an existing destination (data loss)

1 participant