Filesystem MCP server
Reference MCP server for secure local file access: read, write, edit, search, and explore within allowed directories.
Filesystem is one of the active reference servers maintained in the official Model Context Protocol repository, and it gives an agent controlled access to the local file system. It can read text and media files, read many files at once, create and overwrite files, make targeted line edits with pattern matching, create directories, list and tree directory contents, move and rename entries, search recursively by pattern, and report detailed file metadata - everything an agent needs to work with a codebase or document set on disk.
The defining feature is its sandbox: the server only operates inside the directories you explicitly allow. You pass those allowed paths as command-line arguments to the npx invocation, or a client can supply them dynamically through the MCP Roots protocol, which fully replaces the server-side list when provided. If no directory is allowed, the server refuses to start. That makes it a safe, foundational building block for any agent that has to read or change files without granting it the whole machine.
Quick install
Copy-paste configs are provided for all 8 supported clients. Pick your client below.
Add to ~/.claude.json
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-filesystem",
"/path/to/allowed/dir"
]
}
}
}claude mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem /path/to/allowed/dirAvailable tools
| Tool | Description |
|---|---|
| read_text_file | Read the complete contents of a file as text, with optional head or tail line limits. |
| read_media_file | Read an image or audio file and return its base64-encoded data with a MIME type. |
| read_multiple_files | Read the contents of multiple files simultaneously. |
| write_file | Create a new file or overwrite an existing file with the given contents. |
| edit_file | Make selective edits to a file using advanced pattern matching, with a git-style diff preview. |
| create_directory | Create a new directory or ensure one already exists, including parent directories. |
| list_directory | List the contents of a directory with [FILE] and [DIR] prefixes. |
| list_directory_with_sizes | List directory contents with [FILE] and [DIR] prefixes including file sizes. |
| directory_tree | Get a recursive JSON tree of a directory's contents. |
| move_file | Move or rename files and directories. |
| search_files | Recursively search for files and directories matching or excluding glob-style patterns. |
| get_file_info | Get detailed metadata about a file or directory, such as size, timestamps, and type. |
| list_allowed_directories | List all directories the server is permitted to access. |
What you can do with it
Let an agent work in a project directory
Point the server at a single repository path so the agent can read, edit, and create files there while being unable to touch anything outside that directory.
Bulk read and summarize a document set
The agent uses search_files and read_multiple_files to gather the relevant files, then summarizes or refactors them in one pass.
FAQ
- Is it free?
- Yes. It is an open-source reference server in the official Model Context Protocol repository with no paid tier.
- Does it support remote/OAuth?
- No. It runs locally over stdio and needs no authentication; access is restricted to the directories you allow rather than by a login.
- How do I restrict which folders it can touch?
- Pass the allowed directories as arguments to the npx command, or have your client send them via the MCP Roots protocol, which replaces the server-side allow list. With no allowed directory the server will not start.