MCP serverData & DatabasesVerified Last verified 2026-07-24

Filesystem MCP Server

by Model Context Protocol

A reference MCP server that exposes safe, sandboxed filesystem access. You grant it specific directories; the agent can then list, read, search, and (optionally) write files within only those roots — useful for giving a chat-based agent access to a local project without opening a full IDE.

Official page

Works with

Any MCP Client Claude Code Claude (Desktop & Web)Cursor Windsurf Cline VS Code Zed

The Model Context Protocol (MCP).

When to use it

Giving a desktop chat agent access to a local folder of docs or code
Batch operations across a directory the agent should stay inside

When not to

Pointing it at your home directory or system root — always scope to a project folder

What it does

List, read, and search files within allowed directories
Create and edit files (when write access is granted)
Sandboxed to the roots you specify — nothing outside them

How to install

Setup steps with copy-paste config. Sources are cited under each method.

npx (per-project roots)

Requires: Node.js

Add to your MCP config

Pass the allowed directories as arguments — these are the ONLY paths it can touch.

json

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/projects/site"]
    }
  }
}

Restart and verify
Reload the host and confirm the agent lists only the allowed root.

Filesystem MCP Server — documentation · Model Context Protocol · Documentation · accessed 2026-07-24

How to prompt it

Copy-paste prompts written to exercise this plugin, with what to expect.

Summarize a folder of notes

You have a directory of Markdown notes and want a digest.

Read every .md file in the notes root and produce a one-paragraph summary per file, then a combined themes list.

What to expect: The agent enumerates files within the allowed root only and returns per-file summaries plus a synthesis — without you pasting anything.

Scope the root tightly; the server refuses paths outside the directories you passed.

Tips for getting the most out of it

Grant the narrowest directory that still contains what the task needs.
Omit write access for read-only tasks — pass roots you're comfortable being modified only when needed.