The Filesystem MCP server is the reference Node.js program from the Model Context Protocol project that lets an AI assistant read, write, search and move files, but only inside folders you allow. You list those folders when it starts, or your app supplies them through Roots. Everything outside them is refused.
| Item | Value |
|---|---|
| npm package | @modelcontextprotocol/server-filesystem |
| Docker image | mcp/filesystem |
| Where it runs | On your own computer, started by your MCP app |
| Access limit | Allowed directories only, from arguments or Roots |
| Tools | 13, of which 9 only read |
Updated
MCP (Model Context Protocol) is an open standard that lets an assistant app call small helper programs called servers. The filesystem server is the one most people install first, because it turns "look at my product descriptions folder" into something the assistant can actually do. This page explains what it can touch, how the folder limit works, and how to keep it read-only. Use the builder below to produce a config you can paste into your app's MCP settings.
Type your folders and choose how to run the server. The JSON updates as you type and nothing leaves your browser.
Read-only mounting is documented for Docker. With npx the server can write inside the folders you list.
Config JSON
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-filesystem",
"/Users/you/Documents/shop-exports",
"/Users/you/Documents/blog-drafts"
]
}
}
}Read-only means the README marks the tool with readOnlyHint true. Destructive means it can overwrite or remove existing content.
| Tool | What it does | Changes files? |
|---|---|---|
| read_text_file | Reads a file as UTF-8 text, optionally only the first or last N lines | No |
| read_media_file | Reads an image, audio or other file as base64 with its MIME type | No |
| read_multiple_files | Reads several files at once; one failure does not stop the rest | No |
| list_directory | Lists a folder with [FILE] and [DIR] prefixes | No |
| list_directory_with_sizes | Same listing with sizes, sortable by name or size | No |
| directory_tree | Returns a nested JSON tree of a folder | No |
| search_files | Glob-style search with optional exclude patterns | No |
| get_file_info | Size, times, type and permissions | No |
| list_allowed_directories | Shows which folders the server may use | No |
| create_directory | Creates a folder and any missing parents | Yes, not destructive |
| write_file | Creates or overwrites a file | Yes, destructive |
| edit_file | Replaces matched text, with a dryRun preview option | Yes, destructive |
| move_file | Moves or renames; fails if the destination exists | Yes, destructive |
The folders after the package name become the allowed directories. Requires Node.js on your machine.
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-filesystem",
"/Users/you/Documents/shop-exports",
"/Users/you/Documents/blog-drafts"
]
}
}
}Folders are mounted under /projects. The ro flag stops the server writing to that folder.
{
"mcpServers": {
"filesystem": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"--mount", "type=bind,src=/Users/you/Documents/shop-exports,dst=/projects/shop-exports,ro",
"mcp/filesystem",
"/projects"
]
}
}
}VS Code uses a servers key. ${workspaceFolder} limits the server to the project you have open.
{
"servers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "${workspaceFolder}"]
}
}
}There are two ways to tell the server which folders it may use. The first is to put folder paths after the package name in the config, which fixes the list until you restart. The second is Roots, a feature where the assistant app tells the server which folders are in play and can change that list while running.
The README calls Roots the recommended method. The detail that matters for safety: once your app's Roots are in force, an update with no valid roots revokes all access instead of falling back to the folders you typed.
Point it at a folder of exported product data and ask for a list of items missing descriptions. Point it at your blog drafts and ask for a summary of which posts mention an old price. Point it at a downloaded copy of your site and search for broken image names.
In each case the folder is a copy, not the live site, so a mistaken edit costs nothing. That habit is worth more than any setting.
No. The README states that all filesystem operations are restricted to allowed directories. If the client sends Roots, those replace the command-line folders entirely, so the allowed list is whatever your app last supplied.
If your app supports Roots, the server waits for the app to send them. If the app does not support Roots and you gave no folders, the server logs the reason, closes the connection and exits with status 1.
The README documents one way: run the Docker image and add ro to each bind mount, which makes that folder readonly to the server. Some apps also let you approve or block individual tools, which helps, but the mount is the firmer limit.
Its tool list has no delete tool. It can still destroy content, though: write_file overwrites existing files and move_file removes the source, so both are marked destructive in the README's annotation table.
Not for its work. Every tool sets openWorldHint to false, meaning it only touches the local filesystem inside allowed folders. npx does download the package the first time it runs.
Related: What is an MCP server?, How to build an MCP server, Playwright MCP server, Self-hosted AI agent, Connect MCP in We.Inc.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.