MCP Filesystem Server

Not yet source-checked

Reference MCP server that gives Claude, Cursor, and other MCP clients scoped read/write access to your local filesystem.

Machine-drafted from the vendor's site · not yet source-checkedProfile updated Aug 6, 2026Link checked Oct 23, 2026How we rate

Free· Free and open source (MIT). Self-hosted; no vendor cost.MCP Servers

Visit website →

In short

This tool enables MCP-compatible clients to perform file operations within explicitly allowed local directories. It is best for developers and agent builders who need a secure, standardized way to let LLMs read, write, and edit local files without manual shell scripting.

Best for

Developers and agent builders wiring Claude Desktop, Cursor, VS Code, or a custom MCP client to a scoped local working directory for coding, note-taking, or repo-editing workflows.

Skip if

Teams that need remote filesystem, cloud object storage, multi-tenant access control, or a zero-install setup for non-technical users.

MCP Filesystem Server is the reference Node.js implementation of a Model Context Protocol server for local filesystem access, published by Anthropic's modelcontextprotocol project as @modelcontextprotocol/server-filesystem. It gives any MCP-compatible client (Claude Desktop, Cursor, VS Code's MCP integration, Zed, custom agents built on the MCP SDK, and so on) a well-defined set of tools for reading, writing, editing, listing, searching, and moving files within a sandbox of explicitly allowed directories.

The server exposes roughly 14 tools spanning read operations (read text/media files with optional head/tail, batch reads, directory listings with sizes, metadata lookup, recursive glob-style search, and directory tree generation) and write operations (create/overwrite files, an advanced edit tool with pattern matching and dry-run diff preview, mkdir, and move/rename). Each tool ships with MCP tool annotations flagging read-only status, idempotency, and destructiveness, which helps well-behaved clients gate destructive actions behind user confirmation.

Access control is the load-bearing feature: directories can be pinned via CLI arguments at launch or, preferred, negotiated dynamically through the MCP roots protocol so the client can grant and revoke folders without restarting the server. Everything outside the allowed set is refused. Typical deployment is either npx (`npx -y @modelcontextprotocol/server-filesystem /path/to/project`) or a Docker container with the target folders mounted at /projects, optionally read-only. Configuration snippets for Claude Desktop's claude_desktop_config.json and VS Code's mcp.json are in the README with one-click installers.

It is aimed at developers, prompt engineers, and agent builders who want their LLM to actually touch a repo, notes folder, or working directory without gluing together shell tools by hand, and at anyone standing up an MCP stack who needs a battle-tested reference for how a filesystem server should behave.

Editor's take

This is the server I reach for first when a new MCP client needs real disk access — it's the canonical implementation, the tool surface is generous without being sprawling, and the roots protocol support means I don't have to relaunch it every time I switch projects. Just be deliberate about which folders you expose; the agent will happily edit anything you let it see.

— The AI Tool Bible editorial team

Pros

✅ Official reference implementation maintained by Anthropic's MCP team, so it tracks the spec closely and is safe to build against.
✅ Rich toolset (14 tools) covering read, write, edit, search, tree, and move without needing a second server.
✅ Sandbox model with allowed-directory enforcement plus MCP roots support for dynamic, restart-free scope changes.
✅ Advanced edit tool provides pattern matching, whitespace/indentation preservation, and git-style diff previews with dry-run.
✅ Ships as both npx package and Docker image; one-click install buttons for Claude Desktop and VS Code.
✅ MIT-licensed and open source, so it can be forked or vendored into internal agent stacks.
✅ Tool annotations (read-only / idempotent / destructive) let clients build safer confirmation UX.

Cons

⚠️ Local-only: no built-in remote/SSH/S3 backend, so networked or cloud filesystems need a different server.
⚠️ Security perimeter is only as good as the allowed-directories list; a wide root plus an over-eager agent can still delete or overwrite files.
⚠️ No fine-grained per-tool ACL (e.g. read-only for one folder, read/write for another) beyond the Docker read-only mount trick.
⚠️ Requires a Node.js runtime or Docker on the client machine, which is friction for non-technical users.
⚠️ The `edit_file` tool's pattern-based edits can silently no-op when whitespace differs from expectations if used carelessly.
⚠️ Being a reference server, feature velocity is deliberately conservative; power users often end up forking for extras like symlink policies or richer ignore rules.

Facts

API available: Yes
Open source: Yes (license: NOASSERTION)
GitHub stars: 91,651 (checked Oct 29, 2026)
Last GitHub push: Oct 29, 2026
First commit: Nov 2024
Package downloads (30 d): 175,042 · pypi mcp-server-git · checked Oct 15, 2026

Where this tool sits

MCP Servers MCP reference Servers AI for engineers Open-source AI tools Self-hosted AI tools For Developers Free Forever Linux Mac Open Source Open Source Free

Use cases

Give Claude Desktop scoped access to a code repoLet Cursor or VS Code agents edit project files via MCPRead and search a local notes vaultAutomated file refactors with dry-run diff previewBatch reading logs or configs into an LLM contextDirectory tree exploration for agent onboardingRename/move operations driven by an agentSandboxed file I/O for custom MCP clientsDocker-based read-only mount for safe browsing of a project

Frequently asked

Which MCP clients are compatible with this server?: It works with any MCP-compatible client, including Claude Desktop, Cursor, VS Code's MCP integration, Zed, and custom agents built on the MCP SDK.
How does the server restrict file access?: Access is controlled by pinning allowed directories via CLI arguments or dynamically through the MCP roots protocol. All file operations outside this allowed set are refused.
What file operations are supported?: The server exposes approximately 14 tools for reading, writing, editing, listing, searching, and moving files, including advanced edit features with pattern matching and dry-run diff previews.
Is the MCP Filesystem Server free to use?: Yes, it is free and open source under the MIT license. It is self-hosted and requires no vendor cost.
Can this server access remote or cloud storage?: No, it is local-only and does not have built-in support for remote, SSH, or S3 backends. Networked or cloud filesystems require a different server.