Adaptadores MCP de Sistemas de Archivos

What this pack covers

Most developers wire an agent to one filesystem — usually local disk through the official MCP server — and stop there. Then the next ticket arrives: "download last night's exports from S3", "sync this folder to R2", "pull the customer PDFs from the SFTP drop", "merge files across Google Drive and the team NAS". Each new backend turns into a one-off shell wrapper with its own credential format, no scope enforcement, and zero audit trail.

This pack is the cross-protocol set — ten adapters chosen so an agent can reach local fs, AWS S3, Cloudflare R2, Google Drive, SFTP/FTP, and 30+ multi-cloud backends through one consistent permission model. Where Filesystem Agent + Local Ops goes deep on local file janitor work (Downloads cleanup, dedupe, batch rename), this pack goes wide across protocols.

Three layers: local (1-3), cloud-native (4-7), gateway + policy (8-10).

Why a multi-protocol pack matters

The Model Context Protocol gave agents a clean interface for talking to filesystems, but the protocol doesn't dictate what's on the other end. Different teams end up with very different topologies:

• Indie dev: local disk only. Filesystem MCP is enough.
• Backend team: local + S3 + a CI artifact bucket on R2. Three adapters, three credential stores.
• Enterprise: add SFTP for partner exchanges, Google Drive for finance, an on-prem NAS over SMB. Five-plus backends with different audit requirements.

The picks here are the ones that consistently get four things right: scoped roots (the agent literally cannot see outside the configured paths), read-only-by-default (writes are opt-in per server), structured audit logs (every call into the adapter lands in a grep-able file), and credential isolation (each adapter holds its own secrets, no shared blast radius).

Install order — local → cloud → transit → policy

1. Local first (#1-3). Start with Filesystem MCP pointed at one project directory. Add Desktop Commander when you need terminal + PDF/DOCX text extraction. Use MCP Reference Servers as a sanity check that your host (Claude Code / Cursor / Codex CLI) wires servers correctly.

2. Cloud buckets next (#4-6). Add the AWS MCP server for S3 once you've verified local works. Then Cloudflare Workers MCP if your edge cache and assets live on R2 — same protocol, different storage layer. Google Workspace MCP if Drive is part of the workflow.

3. Transit protocols third (#7-8). rclone (#7) isn't an MCP server itself, but it's the universal cross-cloud copy tool — wire it into Desktop Commander's shell surface and the agent gets 70+ backends through one CLI it already knows. SFTPGo (#8) is the self-hosted SFTP/FTP/WebDAV server you point partners at, with per-user virtual filesystems the agent can mount.

4. Policy layer last (#9-10). Alist (#9) gives the agent a single WebDAV mount that fans out to 30+ cloud backends — useful when you don't want N MCP servers per provider. AgentSeal (#10) is the audit and ACL toolkit you wrap around the whole stack so every adapter call lands in one log with one set of policies.

# Sketch of a wired-up agent host
# ~/.config/claude/mcp.json
{
  "mcpServers": {
    "fs-local":   { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "$HOME/projects"] },
    "fs-aws":     { "command": "uvx", "args": ["awslabs.s3-mcp-server"], "env": { "AWS_PROFILE": "readonly" } },
    "fs-r2":      { "command": "npx", "args": ["-y", "@cloudflare/mcp-server-workers"] },
    "fs-drive":   { "command": "uvx", "args": ["workspace-mcp"], "env": { "GOOGLE_OAUTH_SCOPE": "drive.readonly" } }
  }
}

Four adapters, four scopes, four credential stores. The agent calls fs-aws.list_objects or fs-drive.search_files and the protocol takes care of the rest.

Sandboxing and permission scopes

The single biggest win of this pack over giving the agent raw aws, rclone, sftp shell access is scope enforcement at the protocol boundary:

• Filesystem MCP takes its allowed roots as positional arguments. Anything outside the list isn't visible to the agent — not blocked at write time, not visible at read time either. The agent can't cat ~/.ssh/id_rsa because the server doesn't expose ~.
• AWS MCP servers run under an explicit IAM role. The right pattern is a read-only role for browse operations and a separate mcp-writer role with s3:PutObject only on one bucket prefix, swapped in for the rare write task.
• Cloudflare Workers MCP uses Worker-level bindings — the Worker (not the agent) holds the R2 token, and the agent can only call operations the Worker exposes.
• Google Workspace MCP uses OAuth scopes. drive.readonly is the default; drive.file is the minimum write scope (per-file consent), which is much narrower than the full drive scope most quickstarts paste in.
• SFTPGo isolates each agent into its own virtual filesystem — the agent connects as user mcp-agent and sees only the mounted folders, not the rest of the disk.
• AgentSeal sits across the whole stack and enforces per-tool ACLs plus structured audit. Useful when adapters have inconsistent native logging.

Audit and revoke

Every adapter in this pack writes to a log you can grep. The combined pattern is:

tail -f ~/.tokrepo/logs/fs-*.log | tee ~/.audit/$(date +%F).jsonl

One tail per session, one file per day. When something goes wrong — agent deleted the wrong object, or wrote to the wrong path — you have the call, the arguments, the result, and the timestamp. Pair with versioned buckets on the S3/R2 side (lifecycle rules → 30-day retention) and almost every mistake is recoverable.

Revoking is per-adapter: delete the IAM role, rotate the OAuth refresh token, disable the SFTPGo user, kill the Worker binding. No single credential gives access to multiple backends, which is the only structural protection that scales.

Common pitfalls

• One credential, many backends. The biggest anti-pattern is reusing a personal AWS access key across all your MCP servers. Each adapter gets its own least-privilege role; mixing them defeats the whole point.
• Forgetting OAuth refresh. Google Workspace MCP uses OAuth — the refresh token can expire if unused for six months. Schedule a monthly no-op call from a cron so the token stays warm.
• rclone with full write access by default. rclone respects the remote's permissions, but a misconfigured remote (root key for an S3 account) lets the agent see every bucket. Always create a dedicated rclone remote per task with the narrowest scope.
• SFTPGo audit log rotation. SFTPGo writes verbose logs; without rotation, a busy agent fills the disk in a week. Configure logrotate or the built-in retention.
• Alist as a single point of compromise. Convenience comes at a cost — one Alist instance with credentials for 10 backends is one breach away from 10 problems. Keep Alist behind your VPN, not on the public internet.