MCP server · File system

ReferenceSource ValidatedRead-writeMITUpdated August 2026

Filesystem

Reference MCP server for local file operations — read, search, edit and move files inside the directories you explicitly allow.

Quick verdict

It is the canonical, steering-group-maintained implementation of the most common MCP need, and its allow-list model (positional directories or client roots) makes the blast radius explicit.

  • MaintainerModel Context Protocol reference servers (reference)
  • Security scopeRead-write
  • Transportsstdio
  • Install channelnpm · @modelcontextprotocol/server-filesystem
  • EvidenceSource Validated
  • LicenseMIT · Open source

The Model Context Protocol reference server for filesystem operations. It exposes read, search, edit, create and move tools for files and directories, restricted to the allowed directories you pass as arguments (or that the client provides through the MCP roots protocol) — the server refuses to start with no allowed directory at all. Maintained in the MCP steering group's reference repository as an educational implementation rather than a hardened product.

MCP security best practices

Install Filesystem

npx -y @modelcontextprotocol/server-filesystem

Config entry (mcpServers)
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "<ALLOWED_DIRECTORY>"]
    }
  }
}

Credentials

No credentials required.

Verified configurations

Not run by us yet. This profile is Source Validated: the install channel, config entry, credentials and license were checked against the source and upstream metadata, but no configuration has been installed, discovered and executed in a recorded environment. When one is, it appears here with the eight scope dimensions below.

Best for

Giving a local agent scoped access to a project folder — reading, searching and editing files without handing it your whole home directory.

Why use it

It is the canonical, steering-group-maintained implementation of the most common MCP need, and its allow-list model (positional directories or client roots) makes the blast radius explicit. Every major MCP client's documentation uses it as the first example, so setup friction is minimal.

Tradeoffs

Read-write by design: write_file, edit_file, create_directory and move_file all mutate disk inside the allowed directories, so scope paths as narrowly as possible and never pass a home directory or a drive root. The reference repository states these servers are educational examples, not production-hardened solutions. The reference repository is mid-way through a licence transition — new contributions are Apache-2.0 while existing code remains MIT.

Upstream state

npm package published · repository active. Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.

Editorial review

Reviewed byOpenSourcesAI EditorialLast updatedAugust 2026Sourcessrc/filesystem/README.md — tools, allowed-directory and roots rules, npx and Docker configs; modelcontextprotocol/servers README — Reference Servers list, security warning, licence transition; npm: @modelcontextprotocol/server-filesystem

Grade B — Source Validated. Re-review is due by 2027-02-16. Config entries, credential names and package status can change upstream; verify against the source repository before granting an agent access.

Sources

Related guides

All MCP servers →