edit-file is what separates this from a plain FTP wrapper: an exact string is replaced in place, so fixing a line in a config on a remote host stops meaning download, edit, push the whole thing back. The credential handling is the other half — SSH keys can come from 1Password by reference rather than from disk, and username, password and passphrase can sit in the config as encrypted enc: values with the key in the OS keychain, which is what stops a client config being a plaintext credential store.
A file-management client for FTP, FTPS and SFTP: directory listings, binary-safe uploads and downloads, exact-text edits in place, appends, renames and moves, directory creation and deletion — over whichever of the three protocols the server speaks.
- A remote directory listed
- A file downloaded — text as it is, binary base64-encoded — and uploaded the same way
- An exact string replaced inside a remote text file, without re-uploading the whole file
- Content appended to a file, which is created if it does not exist
- Files and directories renamed or moved, directories created, and files and directories deleted
- FTP on port 21, FTPS by turning TLS on over the FTP path, or SFTP on port 22, already encrypted by SSH
- SFTP authentication by SSH private key or password, with the key taken from FTP_PRIVATE_KEY_PATH or the usual ~/.ssh candidates in order
- The private key read from 1Password by reference instead of from disk, resolved lazily and held only in memory
- Credentials stored as AES-256-GCM encrypted enc: values, with the key kept in the OS keychain
Node.js 18.14 or newer, run with npx -y mcp-server-ftp over stdio. FTP_HOST, FTP_PORT, FTP_USER and FTP_PASSWORD identify the server; FTP_PROTOCOL picks ftp or sftp, and FTP_SECURE=true enables TLS — which only means anything on the ftp path, since SFTP is encrypted already. For SFTP, FTP_PRIVATE_KEY_PATH takes either a key path or an op:// 1Password reference, which needs the 1Password CLI installed and already authenticated, and FTP_PASSPHRASE unlocks the key. To keep plaintext credentials out of a client config, store them in the enc: format under a 64-character hex FTP_ENCRYPTION_KEY, and hold that key in the OS keychain rather than beside the values it protects. Uploads, downloads and appends may use short-lived local temporary files, removed after each operation.
One command plus a key — npx -y @smithery/cli install alxspikers-team/mcp-server-ftp --client claude, then supply credentials