What it is
Filesystem is one of the seven reference servers still maintained by the MCP steering group in the main modelcontextprotocol/servers repository; unlike GitHub, Postgres or Slack, it has not been moved to the archive. It gives an AI assistant 13 tools to read and write files, edit them with diff output, create and list directories, move files, search by pattern and read file metadata. Version 2.0.0, released on 19 October 2026, supports both the 2026-07-28 protocol and 2025-era clients, and needs Node.js 24 or later.
Access is limited to allowed directories, passed on the command line (npx -y @modelcontextprotocol/server-filesystem /path/to/dir). Older clients that support MCP Roots can still replace them at runtime, but Roots is deprecated in the 2026-07-28 spec. The npm package was downloaded about 440,000 times in the week to 18 October 2026.
Install
npx -y @modelcontextprotocol/server-filesystem /path/to/allowed/dirOur review
The reference Filesystem server is alive and maintained in the main modelcontextprotocol/servers repository, and it received a substantial update on 19 October 2026. Version 2.0.0 speaks both the new 2026-07-28 protocol and the older 2025 handshake, and raised the minimum Node.js version to 24, which will break configurations on older machines. About 440,000 npm downloads a week show how many setups still lean on it.
Thirteen tools cover what a chat app lacks: read_text_file with head and tail, read_media_file, read_multiple_files, write_file, edit_file with a git-style diff and a dryRun preview, directory listings and trees, search_files, move_file, get_file_info and list_allowed_directories. Every call is checked against the allowed directories, and each tool carries read-only, idempotent and destructive hints so a client can ask before writing. There is no delete tool, a sensible omission.
The access model changed with the new protocol. MCP Roots, which let a client swap the allowed folders at runtime, is deprecated in the 2026-07-28 spec, so for a modern client the command-line directories are the whole allow-list. The 2.0 line also tightened roots handling: an update with no valid roots now revokes access rather than falling back. History argues for staying current. In July 2025 two high-severity advisories, CVE-2025-53109 and CVE-2025-53110, showed that symlinks and look-alike path prefixes could escape the sandbox; they were fixed in 0.6.3 and 2025.7.1.
The MCP project says plainly that these servers are educational examples, not production products. write_file overwrites in place and is not crash-atomic, and pointing the server at a home directory hands the model every dotfile and key in it. The Docker image with read-only bind mounts, documented in the README, is the safer pattern. Claude Code, Cursor and Codex ship better file tools of their own, so the server's real home is Claude Desktop and custom agents built on an SDK.
Where it earns its place
An operations manager using Claude Desktop on a work laptop
Let the assistant read and tidy a folder of meeting notes and reports
Add the npx config with one allowed directory, such as ~/Documents/ops. The model can summarise, rename with move_file and rewrite files; there is no delete tool, but write_file overwrites, so keep the folder in a synced or backed-up location.
A developer building a document-processing agent on an MCP SDK
Give the agent sandboxed file access without writing file tools
Run the mcp/filesystem Docker image with the workspace bind-mounted under /projects and reference data mounted read-only. Thirteen annotated tools save writing and securing your own; it costs nothing, but the project offers no production support.
A security engineer approving MCP servers for 50 desktops
Decide whether the filesystem server is safe to allow
Require 2.0.0 or later (versions before 0.6.3 and 2025.7.1 carry the sandbox-escape CVEs), allow project folders only and never the home directory, and prefer read-only Docker mounts where users only need to read.
Before you commit
- Setup
- npx -y @modelcontextprotocol/server-filesystem /path/to/dir in Claude Desktop's config, one-click install buttons for VS Code, or the mcp/filesystem Docker image. Needs Node.js 24 or later for npx; tools are available as soon as the client restarts.
- Integrations
- 13 tools: nine read-only (read_text_file, read_media_file, read_multiple_files, list_directory, list_directory_with_sizes, directory_tree, search_files, get_file_info, list_allowed_directories) and four that write (create_directory, write_file, edit_file, move_file). Local only; every tool sets openWorldHint to false.
- Data and privacy
- Reads and writes anything in the allowed directories with your user permissions; nothing leaves the machine except what the client sends to its model. Docker ro mounts make a folder read-only. Two high-severity sandbox-escape advisories, CVE-2025-53109 and CVE-2025-53110, were fixed in July 2025.
- Cost at scale
- Free and MIT-licensed. The running cost is context: 13 tool definitions on every request, plus directory_tree and read_multiple_files results that can fill a context window quickly in large folders.
- Limits
- Writes are not crash-atomic, move_file fails if the destination exists, and there is no delete tool. On 2026-07-28 clients Roots cannot change the allow-list, and a server started with no directories answers every call with an error.
What's good
- Allowed-directory checks on every call
- Tool hints separate read-only from destructive operations
- edit_file shows a diff and supports dry runs
- Maintained by the MCP project; 2.0.0 released 19 October 2026
What's not
- Described by the MCP project as a reference, not production-ready
- Overwrites are not crash-atomic
- 2.0.0 requires Node.js 24 or later
- Redundant in coding agents with built-in file tools
Best for
Users of Claude Desktop or custom agents who need controlled access to one or two local folders.
Alternatives
Filesystem (reference server): common questions
- Is Filesystem (reference server) worth it?
- Still the cleanest way to hand a chat app one folder and nothing more, provided you remember the MCP project itself calls it a teaching example. We rate it 4.1 out of 5.
- How much does Filesystem (reference server) cost?
- Free and open source.
- What are the downsides of Filesystem (reference server)?
- Described by the MCP project as a reference, not production-ready; overwrites are not crash-atomic; 2.0.0 requires Node.js 24 or later; redundant in coding agents with built-in file tools.
- Who is Filesystem (reference server) best for?
- Users of Claude Desktop or custom agents who need controlled access to one or two local folders.
- How much does Filesystem (reference server) cost for a team or in production?
- Free and MIT-licensed. The running cost is context: 13 tool definitions on every request, plus directory_tree and read_multiple_files results that can fill a context window quickly in large folders.
- Is Filesystem (reference server) safe for company data?
- Reads and writes anything in the allowed directories with your user permissions; nothing leaves the machine except what the client sends to its model. Docker ro mounts make a folder read-only. Two high-severity sandbox-escape advisories, CVE-2025-53109 and CVE-2025-53110, were fixed in July 2025.
- What are the best Filesystem (reference server) alternatives?
- The closest alternatives we have reviewed are Git (reference server) and Memory (reference server).
Answers checked Oct 22, 2026.
Make Filesystem (reference server)? Show this rating on your site
