MCP Roots: Status and What Replaced Them

Status in the 2026-07-28 spec: deprecated (still functional; eligible for removal in the first spec released on or after 28 July 2027)

Roots are an MCP feature that lets an AI app tell a server which folders or files the user is working in. A coding assistant, for example, could share "this project folder" so a file-search server knows where to look.

The 2026-07-28 MCP specification deprecated Roots. They still work, but new implementations should not adopt them. The spec's migration path is to "pass directories or files via tool parameters, resource URIs, or server configuration instead." This page explains roots, their timeline, and how to replace them.

Why roots existed

A local server that searches code, runs linters or reads documents needs to know where to work. Asking the model to guess folder paths is unreliable. Roots gave clients a standard way to say "these are the directories that matter right now."

The Roots page of the spec says roots "inform servers about the directories and files the client considers relevant." Servers can then focus their work there. Clients usually exposed them through a workspace or project picker.

Roots have been in MCP since the first published spec, 2024-11-05.

How roots work in 2026-07-28

During the deprecation window, roots still function. A client that supports them declares the roots capability inside _meta on each request.

Because servers can no longer start requests, the server asks for roots through Multi Round-Trip Requests. It returns an input_required result containing a roots/list request. The client answers by retrying the original call with the list. Here is the client's answer, from the spec:

{
  "roots": [
    {
      "uri": "file:///home/user/projects/myproject",
      "name": "My Project"
    }
  ]
}

Each root has a uri, which must be a file:// URI, and an optional display name.

Roots are guidance, not a fence

This point matters for security reviews. The 2026-07-28 page states that roots "are informational guidance rather than an access-control mechanism. The protocol does not enforce that servers stay within roots."

The older 2025-11-25 wording said roots "define the boundaries of where servers can operate." That phrasing could suggest a security boundary. The current text removes that impression. If you need a real boundary for a local server, use operating-system controls such as sandboxing. See sandboxing local MCP servers.

What changed across spec versions

The 2026-07-28 changelog lists notifications/roots/list_changed among the removed methods, along with ping and logging/setLevel. The wider reasons are covered in why MCP became stateless.

The deprecation timeline

The deprecated features registry lists Roots with:

Earliest removal is when Roots become eligible. Core Maintainers decide the actual removal, which may come later. The feature lifecycle policy sets the twelve-month minimum.

How to replace roots

The spec names three options. Pick the one that matches how your users work.

1. Tool parameters. Add a path or directory argument to the tools that need it. The model fills it in from the conversation, and the user sees it in the approval prompt. Our guide to MCP tool input schemas shows how to describe it well.
2. Resource URIs. Expose the files or folders as MCP resources and let the client pick them.
3. Server configuration. For a fixed workspace, set the allowed folder when the server is installed, for example as a command-line argument or environment variable.

Whichever you choose, validate every path on the server. Reject paths that escape the intended folder through .. or symbolic links.

Common mistakes

• Treating roots as a security control. The protocol never enforced them. Enforce limits in your server and the operating system.
• Building new features on roots. The spec says new implementations "SHOULD NOT adopt" them.
• Waiting for roots/list_changed. That notification no longer exists in 2026-07-28.
• Skipping path validation. The spec tells clients to validate root URIs "to prevent path traversal." Servers should validate every path they receive, whatever the source.

Next step

Roots were deprecated alongside Sampling and Logging. Read MCP Logging: status in the current spec next, or see the full list in what changed in the July 2026 MCP specification.

Frequently asked questions