File System MCP Server
Local directory and file management for MCP clients with path-based access control.
Data last scanned today · Reviewed today
Overview
This Node.js server provides full filesystem integration, enabling AI assistants to read, write, move, and delete files, as well as manage directory structures. It supports searching for files and retrieving detailed metadata to inform AI interactions with local storage. Access is strictly limited to authorized directories defined at startup via command-line arguments or dynamically through the MCP Roots protocol. The server requires at least one defined root directory to function and supports runtime updates when paired with compatible clients.
Our verdict
This server carries a high risk level with a security score of 56/100. The primary security concern is the lack of any authentication method, meaning any user or process with access to the configuration can execute arbitrary filesystem operations. Additionally, the server does not enforce a read-only mode, providing full write and delete permissions by default. It is recommended for use only in isolated, trusted environments.
- Maintained directly by the official Model Context Protocol organization
- Small footprint with only four direct project dependencies
- Supports dynamic directory updates through the MCP Roots protocol
- Active development with commits recorded within the last week
- No built-in authentication mechanism for incoming connections
- Default implementation allows write and delete operations without read-only restrictions
- License status is marked as NOASSERTION
Setup
{
"mcpServers": {
"filesystem": {
"args": [
"-y",
"@modelcontextprotocol/server-filesystem"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| read_text_file | Read complete contents of a file as text | low |
| read_media_file | Read a file and return it as a base64-encoded content block with its MIME type | low |
| read_multiple_files | Read multiple files simultaneously | low |
| write_file | Create new file or overwrite existing (exercise caution with this) | high |
| edit_file | Make selective edits using advanced pattern matching and formatting | high |
| create_directory | Create new directory or ensure it exists | medium |
| list_directory | List directory contents with [FILE] or [DIR] prefixes | low |
| list_directory_with_sizes | List directory contents with [FILE] or [DIR] prefixes, including file sizes | low |
| move_file | Move or rename files and directories | high |
| search_files | Recursively search for files/directories that match or do not match patterns | low |
| directory_tree | Get recursive JSON tree structure of directory contents | low |
| get_file_info | Get detailed file/directory metadata | low |
| list_allowed_directories | List all directories the server is allowed to access | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Alternatives
Badge
Maintain this server? Add the live badge to your README.