MCP Filesystem Server
Official MCP reference server exposing sandboxed filesystem operations to AI agents.
About
The official reference MCP server for filesystem access. It exposes read/write, search, and metadata tools over a strictly sandboxed directory list: the server starts with an allowed-directories set (from CLI args or the client's MCP Roots), and any path outside it is refused. Roots can be updated at runtime via roots/list_changed notifications, and a client that revokes all roots leaves the server with zero accessible paths.
It ships as an npm package (@modelcontextprotocol/server-filesystem) and a Docker image. Filesystem access is the highest-risk MCP capability class, and this server is the canonical example of how to scope it.
What it can do
- Read/write files within allowed directories only
- Directory listing, recursive search, and file metadata
- Path traversal refused outside the allowed set
- MCP Roots support for runtime directory updates
- Fails closed when no directories are configured
Setup
- Install Node.js 18+.
- Add to your MCP client config: command
npx, args["-y", "@modelcontextprotocol/server-filesystem", "/path/to/allowed/dir"](Docker:mcp/filesystemimage, mount dirs under/projects). - Restart the client; the server fails closed (exits) if no allowed directories are configured and the client does not support Roots.
- Verify with the MCP Inspector before granting broad paths.
Prerequisites
An MCP-compatible client (Claude Code, Cursor, etc.); Node.js 18+ or Docker.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier). The official Anthropic reference implementation with ~91k monorepo stars, actively pushed, and a genuinely well-designed sandbox: allowed-directory scoping plus MCP Roots with fail-closed behavior, all verified in the README. Docked for the license (project-wide MIT→Apache-2.0 transition, mixed state) and because the capability itself is high-risk — a misconfigured roots set exposes the disk, which is a deployment-footgun note rather than a code flaw.
★ 91,183 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.2/10
- Maintenance · recency, releases, issue load
- 9.2/10
- Openness · license + docs
- 8.3/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · 91,183 GitHub stars (log-scaled vs catalog peers)
- · last push 1d ago; 9 releases/12mo; 488 open issues
- · manual review: official reference; allowed-directory sandboxing + MCP Roots verified in README; powerful — misconfigured roots expose the disk; license: MIT transitioning to Apache-2.0 (project-wide relicense in progress; LICENSE file)
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.