MCP Directory

Filesystem (Reference)

Official

Official MCP reference server for secure local filesystem read/write within allowed directories.

Verified
stdio (local)
No auth
TypeScript

Add to your client

Copy the config for your MCP client and paste it into its config file.

Install / run
npx -y @modelcontextprotocol/server-filesystem /absolute/path/to/dir

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "filesystem-reference": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/absolute/path/to/dir"
      ]
    }
  }
}

Before you start

  • Node.js 18+ (to run via `npx @modelcontextprotocol/server-filesystem`), OR Docker if using the container image
  • No credentials or auth — access is granted by listing allowed directories as args, or via the client's MCP Roots support
  • One or more directory paths you intend to expose to the model

About Filesystem (Reference)

The Filesystem server is one of the official Model Context Protocol reference servers, maintained in the modelcontextprotocol/servers repo. It gives an MCP client (Claude Desktop, VS Code, Cursor, etc.) the ability to read, write, edit, move, and search files on the local machine — but only inside directories you explicitly allow.

Access is sandboxed two ways: you pass allowed directories as command-line arguments at startup, or the client supplies them dynamically via the MCP Roots protocol (the recommended approach). Any operation that resolves to a path outside the allowed set is rejected, which is what makes it safe to hand an agent filesystem access.

Beyond plain reads and writes, it offers a pattern-based edit_file for surgical line edits, recursive search_files with glob patterns, a JSON directory_tree, and media reads that return base64 for images/audio. It runs over stdio with no authentication, and can run via NPX or a Docker image that mounts host paths into /projects (optionally read-only).

Tools & capabilities (13)

read_text_file

Read a file's contents as UTF-8 text (supports head/tail line limits).

read_media_file

Read an image or audio file and return it as base64.

read_multiple_files

Read several files at once in a single call.

write_file

Create a new file or overwrite an existing one.

edit_file

Make selective line-based edits using pattern matching, returning a git-style diff.

create_directory

Create a directory, including any missing parent directories.

list_directory

List directory contents with [FILE]/[DIR] type prefixes.

list_directory_with_sizes

List directory contents including each entry's size.

directory_tree

Return a recursive JSON tree of a directory.

move_file

Move or rename a file or directory.

search_files

Recursively search for files/directories matching a glob pattern.

get_file_info

Return detailed metadata (size, timestamps, permissions) for a path.

list_allowed_directories

Show which directories the server is permitted to access.

When to use it

  • Use it when you want an agent to read and edit a codebase or document set that lives on your local disk.
  • Use it when you need bulk file operations — read many files, search by glob, or generate a directory tree for context.
  • Use it when you want strict sandboxing: expose only specific folders and reject everything else.
  • Use it when you need surgical, diff-style edits to files rather than full rewrites (`edit_file`).
  • Use it when running in Docker and want to mount certain project folders read-only for safety.

Quick setup

  1. 1Pick the directories you want to expose (e.g. ~/projects/myapp).
  2. 2Add the server to your MCP client config, e.g. command `npx` with args `-y @modelcontextprotocol/server-filesystem /path/to/allowed/dir`.
  3. 3Alternatively use the Docker image `mcp/filesystem`, mounting host paths into `/projects` (append `,ro` to a mount for read-only).
  4. 4Restart the MCP client so it launches the server.
  5. 5Verify by asking the model to call `list_allowed_directories` or `list_directory` on an exposed path.

Security notes

Only the directories passed as arguments are accessible, but any granted directory is fully readable and writable; scope it to a project folder rather than your home directory. Never grant root or system paths.

Filesystem (Reference) FAQ

How do I restrict which folders the model can touch?

Pass each allowed directory as a command-line argument when launching the server, or have your client supply them via MCP Roots. Any path outside that set is rejected.

Does it require an API key or login?

No. It runs locally over stdio with no authentication. Security comes entirely from the allowed-directory sandbox.

Can I make a directory read-only?

Yes, most easily with the Docker image by appending `,ro` to the bind mount (e.g. `/host/path,dst=/projects/foo,ro`).

Why am I getting an 'access denied' / path error?

The path resolves to a location outside the allowed directories. Confirm the folder is listed in your args or Roots, and watch out for symlinks that point outside the sandbox.

Which clients support it?

Any MCP client — it's commonly configured in Claude Desktop, VS Code (`.vscode/mcp.json`), Cursor, and others.

Alternatives to Filesystem (Reference)

Official MCP server for reading, searching, and manipulating a local Git repository's files and history.

Verified
stdio (local)
No auth
Python
12 tools
Updated 5 months agoRepo

Official AWS Labs MCP server to manage and query S3 Tables (table buckets, namespaces, tables).

Verified
stdio (local)
API key
Python
12 tools
Updated 1 month agoRepo

Powerful local filesystem + terminal MCP server: search, diff-edit files, and run shell commands.

Verified
stdio (local)
No auth
TypeScript
8 tools
Updated 4 months agoRepo