MCP File System Servers: Local, Cloud, Enterprise (2026)

File system servers form the foundation of the Model Context Protocol (MCP) server ecosystem. Independent evaluations of every significant server in this category, covering local file access, cloud storage, and enterprise document management, not directory listings or vendor documentation.

MCP lets AI clients read, write, edit, search, and organize files through a standardized JSON-RPC 2.0 interface. Anthropic introduced MCP as an open standard in November 2024. The Linux Foundation’s Agentic AI Foundation (AAIF) now governs the specification (Linux Foundation, “Agentic AI Foundation Launch,” December 9, 2025). 8 servers compete in this category as of mid-2026. The Anthropic Filesystem reference server remains the most-installed MCP server in the entire ecosystem.

The full MCP server directory covers all 14 server categories. This page focuses on file system and storage servers alone.

What Does a File System MCP Server Do?

A file system MCP server exposes file reading, writing, editing, searching, and directory management as callable tools. The AI client requests a file operation through JSON-RPC. The server executes the operation within a scoped directory or cloud storage account and returns the result.

File system servers operate on private, permission-scoped data. Every file operation occurs within boundaries the user explicitly authorizes. The Filesystem reference server restricts access to directories listed in its startup arguments. Cloud servers restrict access through OAuth tokens scoped to a user’s storage account.

3 storage scope types define this category:

Local filesystem servers access files on the user’s machine. The Filesystem reference server and Desktop Commander MCP use this scope. Zero network latency. Zero cloud dependency. Files never leave the machine.
Cloud storage servers connect to Google Drive, Dropbox, OneDrive, and S3 through vendor APIs. Files exist across devices. Collaboration features persist. Network access is required.
Enterprise platform servers connect to SharePoint, Box, and document management systems. Permission models, compliance controls, and audit trails apply at the organizational level.

The Filesystem reference server is most users’ first MCP server. The 300 lines of TypeScript source code serve as the template for writing custom MCP servers in the ecosystem.

How Do You Evaluate File System Servers?

Evaluate file system servers on 5 criteria: storage scope, security model, vendor maintenance status, tool surface breadth, and token cost per tool definition. These dimensions separate a safe integration from a data exposure risk.

Storage Scope

Local servers access files on one machine. Cloud servers access files across devices and users. Enterprise servers access files across an organization with compliance controls. Match the scope to the workflow. A developer editing local project files needs the Filesystem server. A team sharing documents across offices needs Google Drive or SharePoint.

Security Model

The Filesystem server uses a directory allowlist: only directories named in startup arguments are accessible. Google Drive MCP uses OAuth 2.0 scoped to the authenticated user’s permissions. S3 MCP uses API keys scoped to an AWS account. The security model determines what happens when an agent attempts to access data outside the intended scope.

Vendor Maintenance Status

Google, Microsoft, and Dropbox shipped official MCP servers in March-April 2026. AWS provides S3 MCP support. Anthropic maintains the Filesystem reference server. Official vendor servers receive security patches and API updates. Community servers depend on volunteer maintenance.

Tool Surface Breadth

The Filesystem server exposes 11 tools. SharePoint MCP exposes 33 tools. OneDrive MCP exposes 14 tools. Broader tool surfaces increase context window consumption. Each tool definition occupies 500 to 2,500 tokens.

Token Cost Per Tool Definition

The Filesystem server consumes approximately 800 tokens for its tool definitions at session start. Cloud servers with larger tool surfaces consume 2,000 to 5,000 tokens. Token cost compounds with conversation length: the model re-reads tool definitions on every turn.

The rubric above applies to every server profiled in the next section.

Which Servers Access Files and Storage Through MCP?

8 file system servers expose MCP-compatible tools as of mid-2026. The Anthropic Filesystem reference server leads with 170,000+ weekly npm downloads. Google Drive, OneDrive, SharePoint, and Dropbox shipped official vendor servers in March-April 2026.

Filesystem MCP (Anthropic Reference)

Anthropic maintains the Filesystem MCP server as one of 7 active reference implementations. The server exposes 11 tools: read_file, read_multiple_files, write_file, edit_file, create_directory, list_directory, directory_tree, move_file, search_files, get_file_info, and list_allowed_directories. Weekly npm downloads exceed 170,000. Docker pulls exceed 100,000.

Security relies on directory allowlists. Directories specified via command-line arguments are accessible. All others are blocked. The Roots protocol enables dynamic directory updates from the MCP client without server restart. No network access is required. Transport: stdio. Runtime: Node.js 18+.

The Filesystem server is the most-installed MCP server across the entire ecosystem. Its minimal surface area (11 tools, ~800 tokens) makes it the lowest-overhead option for local file access.

Google Drive MCP

Google maintains the official Google Drive MCP server as part of the Google Workspace suite. The server is remote hosted at drivemcp.googleapis.com. Auth: OAuth 2.0 through a Google Cloud project. The server exposes tools for searching files, reading content across Google Docs, Sheets, and Slides, creating and uploading files, and managing folders and shared drives.

The Google Workspace suite separates Drive, Gmail, Calendar, People, and Chat into 5 independent MCP servers. Each authenticates independently through the same Google Cloud project. Agents install only the servers they need.

Desktop Commander MCP

Desktop Commander extends the Filesystem reference server with terminal command execution, process management, and search-and-replace file editing. The server combines file operations with shell access in a single MCP surface. Node.js 18+ required.

Desktop Commander targets developers who need both file access and terminal control from one server. The extension relationship is direct: Desktop Commander builds on top of the Filesystem server’s codebase and adds capabilities the reference implementation intentionally excludes.

OneDrive MCP (Microsoft Work IQ)

Microsoft maintains the OneDrive MCP server under the “Work IQ” intelligence layer. The server exposes 14 tools for CRUD operations on files and folders within OneDrive. The microsoft/work-iq repository holds the implementation (805 GitHub stars). An M365 Copilot license is required.

SharePoint MCP (Microsoft Work IQ)

Microsoft maintains the SharePoint MCP server alongside OneDrive under Work IQ. The server exposes 33 tools for document management, library access, site navigation, and permission handling. SharePoint’s enterprise permission model applies: agents access only content the authenticated user can view. The tool surface is the broadest in this category.

Dropbox MCP

Dropbox shipped its official MCP server in April 2026. The server is remote hosted at mcp.dropbox.com (beta). Tools expose file browsing, reading, searching, creating, moving, and sharing through natural language commands. OAuth authentication connects to the user’s Dropbox account.

The April 2026 launch made Dropbox the third major cloud vendor (after Google and Microsoft) to ship an official MCP server within a single month.

S3 MCP (AWS)

AWS provides MCP server support for Amazon S3. The server exposes bucket listing, object operations, policy management, tagging, and pre-signed URL generation. API key authentication scoped to an AWS account. The server targets cloud-native storage workflows where files live in S3 buckets rather than local directories or consumer cloud drives.

OpenDAL MCP

The Apache OpenDAL project provides an MCP server that connects to 40+ storage backends through a single interface. Supported backends include S3, Azure Blob Storage, Google Cloud Storage, HDFS, WebDAV, FTP, SFTP, and the local filesystem. One server replaces backend-specific implementations. The tradeoff: broader coverage with less depth per backend compared to vendor-specific servers.

Server selection depends on where the files live. The Filesystem server is the default for local access. Google Drive MCP covers Google Workspace teams. OneDrive and SharePoint cover Microsoft-stack organizations. Dropbox MCP covers Dropbox users. S3 and OpenDAL cover cloud infrastructure.

The sections above define file system MCP servers, provide an evaluation rubric, and profile every significant server in the category. The sections below compare local and cloud storage tradeoffs, explain the directory allowlist security model, and answer the questions that surface during server selection.

When Does Local File Access Outperform Cloud Storage?

Local servers process files on the user’s machine with zero network latency and zero cloud dependency. Cloud servers access files across devices, enable collaboration, and persist data beyond the local machine. The tradeoff is speed and privacy vs accessibility and sharing.

Local file access (Filesystem MCP, Desktop Commander) is faster for every operation. No network round-trip. No API rate limits. No authentication token refresh. Files remain on the machine. Data sensitivity concerns disappear.

Cloud storage access (Google Drive, OneDrive, Dropbox) is necessary when files exist across devices, teams collaborate on shared documents, or organizational compliance requires centralized storage. The agent reads the same file the team edits.

For hybrid workflows, install both. The Filesystem server accesses local project files. Google Drive MCP accesses shared team documents. The 2 servers consume approximately 3,000 tokens combined for tool definitions.

How Does the Directory Allowlist Security Model Work?

The Filesystem reference server restricts access to directories listed in its startup arguments. Operations outside these directories fail. The Roots protocol enables dynamic directory updates without server restart. No network access is required.

The allowlist works in 2 modes. Static mode specifies directories as command-line arguments at server startup. Dynamic mode uses the MCP Roots protocol: the client notifies the server of allowed directories at runtime, completely replacing any static configuration.

The Filesystem server requires no network access. Enable network isolation in container deployments for complete outbound restriction. The server reads and writes files on disk. Nothing else.

Cloud servers use OAuth or API keys instead of allowlists. The security perimeter shifts from “which directories” to “which user’s account.”

Frequently Asked Questions

Which File System Server Do Most Users Install First?

The Filesystem reference server is the most-installed MCP server in the ecosystem, with 170,000+ weekly npm downloads. Most developers install it before any other server.

Does the Filesystem Server Access Files Outside Allowed Directories?

No. The server rejects operations targeting paths outside the configured allowlist. Symbolic links that resolve outside allowed directories are also blocked. The security boundary is enforced at the server level, not at the client level.

Can One Server Access Both Local Files and Cloud Storage?

The OpenDAL MCP server connects to 40+ backends including the local filesystem, S3, Azure Blob, GCS, and FTP through a single interface. For most workflows, separate servers (Filesystem for local, Google Drive for cloud) provide deeper tool coverage per backend.

What Happened to Anthropic’s Google Drive Reference Server?

Anthropic published a Google Drive MCP server as one of its original reference implementations. The server was archived alongside 12 other Anthropic reference servers during 2025-2026. Google now maintains the official replacement at drivemcp.googleapis.com. 7 active reference servers remain: Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking, and Time.

Which MCP Servers Access Files and Storage?