Filesystem MCP Server: Tools, Setup and Security

The Filesystem MCP server lets an AI app read, write, edit, move and search files on your computer. It only touches folders you allow when you start it. It is a reference server published by the Model Context Protocol project in the modelcontextprotocol/servers repository.

Checked against: Filesystem MCP Server README on 28 October 2026. eSEOspace did not install or test this server.

The repository describes all its servers this way: "The servers in this repository are intended as reference implementations to demonstrate MCP features and SDK usage. They are meant to serve as educational examples for developers building their own MCP servers, not as production-ready solutions."

At a glance

What it can do

The README lists these tools.

Read-only tools:

• read_text_file: reads a file as UTF-8 text, with optional head or tail line limits.
• read_media_file: returns an image, audio or other file as base64 with its MIME type.
• read_multiple_files: reads several files in one call.
• list_directory and list_directory_with_sizes: list folder contents.
• directory_tree: returns a recursive JSON tree.
• search_files: glob-style recursive search with exclude patterns.
• get_file_info: size, dates, permissions and hard-link count.
• list_allowed_directories: shows which folders the server may touch.

Write tools:

• create_directory: creates a folder and any parents.
• write_file: creates or overwrites a file.
• edit_file: makes pattern-based edits and returns a git-style diff. It has a dryRun option, and the README's best practice is to "Always use dryRun first."
• move_file: moves or renames files and folders, and fails if the destination exists.

The server sets MCP tool annotations on every tool. Read tools are readOnlyHint: true. write_file, edit_file and move_file carry destructiveHint: true. Our page on MCP tool annotations explains what these hints do and why clients should not trust them blindly.

Large or slow folders have limits. Path lookups wait at most 15 seconds, and search_files and directory_tree stop after 100,000 entries.

How to connect it

Pass every allowed folder as an argument. This is the README's Claude Desktop config using npx:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/Desktop",
        "/path/to/other/allowed/dir"
      ]
    }
  }
}

On Windows, the README wraps the command as "command": "cmd" with "/c", "npx" at the start of args.

The Docker option mounts folders under /projects. Adding ro to a mount makes that folder read-only to the server, which is a simple way to limit risk. The README also gives VS Code configs that use ${workspaceFolder}.

The MCP project's own guide to connecting local servers uses this server as its worked example.

Security notes

Allowed directories are the main control. Command-line folders are the method the README recommends, and "the only method that works on every protocol version." Older clients could replace them at runtime through Roots, but Roots is deprecated as of the 2026-07-28 spec.

Symlinks are checked. Every path is resolved and checked, so a symlink pointing outside an allowed folder is refused.

Hard links are not. The README says checks are path-based. If a file inside an allowed folder is hard-linked from elsewhere, an edit changes it everywhere. It names pnpm's package store as a common case. A hardLinks count above 1 in get_file_info is the warning sign.

Writes are not crash-safe. The README says an overwrite "is not crash-atomic," so a crash mid-write can leave a partial file.

Practical steps: allow the narrowest folders you can, mount read-only with Docker where possible, and keep approval prompts on for write tools. See excessive permissions in MCP, sandboxing local servers and the MCP security center.

Alternatives

• Git MCP server: works inside one repository and gives you version history as a safety net.
• Cloud file servers from Box, Dropbox or Google Drive, if your files live in a shared drive rather than on one laptop.

More profiles are on our MCP server profiles hub.

Next step

Giving an AI app file access is a policy question as much as a technical one. Our MCP readiness audit helps you decide which folders, tools and approval rules make sense for your team.

Frequently asked questions