alebgl77/ftp-deploy-mcp

**The deploy button for AI coding agents.**
Give Claude Code, Claude Desktop, Cursor, Windsurf, Trae, Antigravity, or any
MCP client a focused way to list, read, upload, download, and deploy files on
your own FTP, FTPS, and SFTP servers.
*Version française → README.fr.md*
CLI and MCP language: English by default; use --lang fr or FTP_MCP_LANG=fr.
Language scope and precedence.
Purpose-built deployment controls keep credentials out of tool responses,
support read-only servers and dry runs, and limit local file access with
localRoot. The repository is covered by an extensive end-to-end suite that
runs against local FTP and SFTP servers. There is no telemetry.
> **Availability:** install from source today. The npm package has **not been
> published yet**, so npx -y ftp-deploy-mcp is unavailable. The project still
> lists publication in the Official MCP Registry as pending; registry-based
> installation is not offered here. GitHub source releases are
> separate from npm and Official MCP Registry publication. Existing Glama and
> MCP Index pages are discovery listings, not proof of an installable package.
> This checkout has version 0.2.1. Find published source versions on
> GitHub Releases;
> the published GitHub release v0.2.0 remains unchanged.
Documentation
| Document | English | Français |
|---|---|---|
| Overview and installation | README | README |
| Changes | Changelog | Modifications |
| Contributing | Guide | Guide |
| Security policy | Policy | Politique |
| Security model | Model | Modèle |
| Release process | Guide | Guide |
| Agent evaluation | Instructions | Instructions |
| Agent performance and client integration | Guide | Guide |
| Scripted MCP conformance | Guide | Guide |
| CLI and MCP languages | Guide | Guide |
| MCP error contract | Contract | Contrat |
| Verified staged transfers | Guide | Guide |
| Scan and admission limits | Limits | Limites |
| State storage primitives (internal library, no MCP tool) | Library | Bibliothèque |
| Durable workflow model (internal library, no MCP tool) | Model | Modèle |
| MIT license | Canonical text | Informative translation |
Architecture and scenarios
Explore the current and target architecture diagrams and illustrative scenarios
in the bilingual interactive HTML guide.
The guide and its
English / French
build instructions are in the repository, outside the npm package. After
cloning, open site/index.html locally and use its language selector.
The README banners were generated with ChatGPT Image. Their
provenance and exact prompts
document their illustrative role; they are not a certification.
First source install
1. Install a supported Node.js LTS version: 22 or 24 (minimum: 22).
2. Run git clone https://github.com/alebgl77/ftp-deploy-mcp.git, then
cd ftp-deploy-mcp.
3. Run npm ci --omit=dev --ignore-scripts.
4. Run npm run setup, then edit the generated server config: set an absolute
localRoot, replace credentials, and configure the SFTP host-key pin or the
FTP/FTPS safety acknowledgments described below.
5. Restart the MCP client and try a dry run:
Windows users can run install.cmd and macOS/Linux users can run
./install.sh instead of steps 3–4. Review every generated server entry before
the first connection.
For a tagged version, check out that exact tag before installing. npm ci uses
the sole authoritative package-lock.json, with six exact direct pins and the
reviewed graph. Keep it with the sources. --ignore-scripts disables automatic
dependency lifecycle scripts; setup is a separate, explicit action.
The v0.2.1 source installation asset is named
ftp-deploy-mcp-0.2.1-source.tar.gz: 82 files, including that lockfile. Once its
publication and checksums are verified, extract it in a fresh directory:
This installation archive excludes repository tests and maintainer scripts;
GitHub's automatic source ZIP/tar contains the complete repository. The separate
npm .tgz contains 81 files without a lockfile and remains unqualified: an actual
npm consumer changed ten production dependencies. It provides no locked-install
guarantee. See the release guide for verification and limits.
Protocol and security matrix
| Protocol | Transport identity | Remote-root behavior | Recommended use |
|---|---|---|---|
| **SFTP** | Encrypted. hostKeySha256 is required unless allowUnknownHostKey: true explicitly accepts impersonation risk. | realpath/lstat checks refuse symlink components and keep operations below root. A malicious or changing server can still create a race between validation and use. | Preferred. Pin a fingerprint verified out of band. |