Sweep MCP server
An MCP server that can delete directories, and the guard rails that make that acceptable.
0 stars
Reviews
Write oneNobody has reviewed Sweep yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Sweep tools (3)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
list_targetsreclaimscan
Public scan report
scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it
- Code scan5 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 0 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Sweep compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 92/100
- higher than 95% of 48,255 servers
- Tools
- 3
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
What its tools let an agent do: 3 read
Install Sweep in Claude Code, Cursor or VS Code
claude mcp add sweep-mcp -- uvx sweep-mcp
What the publisher says
From the Sweep repository's README, as published. We do not edit it. Read it on GitHub
<!-- mcp-name: io.github.les-k/sweep-mcp -->
sweep-mcp
In plain terms: this lets an AI clear out the junk folders that pile up
on a developer's machine, and makes it incapable of touching anything else. It
works only inside folders you name, only deletes things it found itself, and
checks again in the instant before deleting — so nothing can be swapped in at
the last second.
An MCP server that deletes directories — and the guard rails that make handing that capability to a language model something other than reckless.
It exposes sweep over the Model Context Protocol, so an agent can find and reclaim nodemodules, .venv, target, pycache__ and friends. The interesting part is not the deleting. It is everything that has to be true before a delete is allowed to happen.
Research published in 2026 found security issues in 66% of 1,808 scanned MCP servers, with 30+ CVEs filed against MCP implementations in a single quarter. This repository is one server written the other way round: the refusals first, the feature second.
The threat model
An MCP server that can delete directories is a loaded gun pointed at whatever the process can reach. Five things could go wrong, and each has a control and a test that makes it fire.
Two smaller ones, for the same reason:
counting id invites an agent to iterate until something deletes.
- Ticket ids are random, not sequential. f-3a91c02b77de, not 1. A
anything read off disk, so a directory named ignore-previous-instructions reaches the model as data rather than as a sentence (testtooldescriptionsarestatic).
- Tool descriptions are string literals. They are never assembled from
What it does not protect against
The controls above are worth exactly what they cover, and no more.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Sweep: common questions
- Is Sweep MCP server safe?
- Yes, by our scan: it is graded A (92/100). Read the Sweep safety report
- How do I install Sweep?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Sweep need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Sweep maintained?
- The last commit was 33 days ago (2026-10-02). The latest release is v0.1.1.
- How does Sweep compare with other MCP servers?
- safety score 92/100 (higher than 95% of 48,255 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.