[danbarr]

The upstream Docker Hub filesystem image is not keeping up with new builds. Package @modelcontextprotocol/server-filesystem 2.0.1 in Dockyard so it follows the existing npm build and update pipeline.

Leave allowed directories to runtime arguments, matching upstream's image entrypoint. The ToolHive catalog supplies /projects by default; explicit runtime arguments can select another directory without retaining access to /projects.

Add and document security.scan_args for scanner-only startup arguments. The filesystem scan supplies /tmp because the scanner has neither catalog defaults nor MCP roots. Set up Node 24 for npm scans to satisfy this package's declared runtime requirement instead of relying on the runner's Node 22.

Validation:

• Built dockhand, generated the Dockerfile, and built the image with Docker.
• Local YARA scan with the CI-pinned scanner 4.8.7 passed across all 14 tools with no findings.
• Container smoke tests passed initialization, tool discovery, mounted-file reads, and denial outside allowed directories for both /projects and /some-other-dir supplied at runtime. Confirmed the custom-directory case does not allow /projects, and neither case allows /tmp.
• Checked scan argument overrides, runtime fallback, empty overrides, and rejection of malformed argument lists.
• Workflow YAML validation and git diff --check passed.

npm provenance attestations are available and identify monorepo release tag v2.1.0. Dockhand detects them but cannot parse npm's bundle wrapper, so the spec records them as unverified.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ server-filesystem

• Status: Passed
• Tools scanned: 14
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅

[toolhive-release-app]

🛡️ Grype Vulnerability Scan Results

✅ No fixable High or Critical vulnerabilities found.

server-filesystem

✅ No blocking findings.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.