MCP Filesystem Server

Reference MCP server that gives Claude, Cursor, and other MCP clients scoped read/write access to your local filesystem.

Free· Free and open source (MIT). Self-hosted; no vendor cost.MCP Servers

Visit website →

Best for

Developers and agent builders wiring Claude Desktop, Cursor, VS Code, or a custom MCP client to a scoped local working directory for coding, note-taking, or repo-editing workflows.

Skip if

Teams that need remote filesystem, cloud object storage, multi-tenant access control, or a zero-install setup for non-technical users.

MCP Filesystem Server is the reference Node.js implementation of a Model Context Protocol server for local filesystem access, published by Anthropic's modelcontextprotocol project as @modelcontextprotocol/server-filesystem. It gives any MCP-compatible client (Claude Desktop, Cursor, VS Code's MCP integration, Zed, custom agents built on the MCP SDK, and so on) a well-defined set of tools for reading, writing, editing, listing, searching, and moving files within a sandbox of explicitly allowed directories.

The server exposes roughly 14 tools spanning read operations (read text/media files with optional head/tail, batch reads, directory listings with sizes, metadata lookup, recursive glob-style search, and directory tree generation) and write operations (create/overwrite files, an advanced edit tool with pattern matching and dry-run diff preview, mkdir, and move/rename). Each tool ships with MCP tool annotations flagging read-only status, idempotency, and destructiveness, which helps well-behaved clients gate destructive actions behind user confirmation.

Access control is the load-bearing feature: directories can be pinned via CLI arguments at launch or, preferred, negotiated dynamically through the MCP roots protocol so the client can grant and revoke folders without restarting the server. Everything outside the allowed set is refused. Typical deployment is either npx (`npx -y @modelcontextprotocol/server-filesystem /path/to/project`) or a Docker container with the target folders mounted at /projects, optionally read-only. Configuration snippets for Claude Desktop's claude_desktop_config.json and VS Code's mcp.json are in the README with one-click installers.

It is aimed at developers, prompt engineers, and agent builders who want their LLM to actually touch a repo, notes folder, or working directory without gluing together shell tools by hand, and at anyone standing up an MCP stack who needs a battle-tested reference for how a filesystem server should behave.

Editor's take

This is the server I reach for first when a new MCP client needs real disk access — it's the canonical implementation, the tool surface is generous without being sprawling, and the roots protocol support means I don't have to relaunch it every time I switch projects. Just be deliberate about which folders you expose; the agent will happily edit anything you let it see.

— The AI Tool Bible editorial team

Pros

✅ Official reference implementation maintained by Anthropic's MCP team, so it tracks the spec closely and is safe to build against.
✅ Rich toolset (14 tools) covering read, write, edit, search, tree, and move without needing a second server.
✅ Sandbox model with allowed-directory enforcement plus MCP roots support for dynamic, restart-free scope changes.
✅ Advanced edit tool provides pattern matching, whitespace/indentation preservation, and git-style diff previews with dry-run.
✅ Ships as both npx package and Docker image; one-click install buttons for Claude Desktop and VS Code.
✅ MIT-licensed and open source, so it can be forked or vendored into internal agent stacks.
✅ Tool annotations (read-only / idempotent / destructive) let clients build safer confirmation UX.

Cons

⚠️ Local-only: no built-in remote/SSH/S3 backend, so networked or cloud filesystems need a different server.
⚠️ Security perimeter is only as good as the allowed-directories list; a wide root plus an over-eager agent can still delete or overwrite files.
⚠️ No fine-grained per-tool ACL (e.g. read-only for one folder, read/write for another) beyond the Docker read-only mount trick.
⚠️ Requires a Node.js runtime or Docker on the client machine, which is friction for non-technical users.
⚠️ The `edit_file` tool's pattern-based edits can silently no-op when whitespace differs from expectations if used carelessly.
⚠️ Being a reference server, feature velocity is deliberately conservative; power users often end up forking for extras like symlink policies or richer ignore rules.

Use cases

Give Claude Desktop scoped access to a code repoLet Cursor or VS Code agents edit project files via MCPRead and search a local notes vaultAutomated file refactors with dry-run diff previewBatch reading logs or configs into an LLM contextDirectory tree exploration for agent onboardingRename/move operations driven by an agentSandboxed file I/O for custom MCP clientsDocker-based read-only mount for safe browsing of a project