What Does the Filesystem MCP Server Do and How Do You Set It Up?

The Filesystem MCP server gives AI assistants read and write access to local files and directories through the Model Context Protocol (MCP). It is one of the seven active reference servers maintained by the MCP project under the Linux Foundation, originally built by Anthropic, and it is the standard first MCP install: no token, no account, one config line or one click in Claude Desktop.

Access control is the whole design. The directories you pass at launch are the only paths the server touches, and it refuses everything outside them. That allowed-directories model makes this server the safest place to learn MCP and the fastest to misconfigure by pointing it at your home folder.

This guide covers what the server exposes, the one-click install in Claude Desktop, the manual config for every other client, how allowed directories work, the Windows traps, security, and the alternatives written in Go and Rust.

All file-system MCP servers · What MCP is and how it works

What Does the Filesystem MCP Server Expose?

The Filesystem server exposes file and directory operations as MCP tools: reads, writes, edits, directory management, search, and metadata.

The tool set groups into four operations:

• Reading: read_file and read_multiple_files return file contents, the answer to “what is the MCP tool to read files.”
• Writing and editing: write_file creates or overwrites a file, and edit_file applies targeted changes inside one.
• Directory operations: create_directory, list_directory, directory_tree, and move_file manage structure.
• Search and metadata: search_files finds files by pattern, get_file_info returns size and timestamps, and list_allowed_directories reports exactly what the server can reach.

The server exposes tools only; it registers no MCP resources and no MCP prompts. Every interaction is a tool call, and each call costs 500 to 2,000 tokens of context window. That cost profile rewards targeted operations: a search_files call followed by one read_file beats reading a directory tree wholesale.

How Do You Install It in One Click?

Claude Desktop installs the Filesystem server from its Connectors panel: Settings, then Connectors, search for File System, click Install, then Add Directory.

1. Open Claude Desktop and go to Settings, then Connectors.
2. Search for File System and click Install.
3. Click Add Directory and choose the folder the model is allowed to touch.
4. Approve the access prompt. The server’s tools appear in the tool list.

The flow ships the server as a Desktop Extension, the .mcpb one-click format Claude Desktop introduced in early 2026, so no JSON editing and no Node.js check are involved (Claude Help Center, March 2026). MCP access in Claude Desktop requires a Claude Pro subscription.

The one-click path trades flags for speed: directory choices live in the extension’s settings panel instead of a config file, and that is the right tradeoff for a first install.

How Do You Configure It Manually?

Every other client, and any Claude Desktop setup that needs full control, takes one config entry: the npx command plus one argument per allowed directory.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/you/Documents/clients",
        "/Users/you/Documents/drafts"
      ]
    }
  }
}

The args array carries the access model. The first two items launch the package. Every item after that grants one directory, so this example allows exactly two folders and nothing else. Add a third path to grant a third folder; remove one to revoke it; restart the client to apply. No token and no env block exist because the directory list is the entire credential.

Two non-Node routes run the same server. The official Docker image is mcp/filesystem on Docker Hub, with allowed directories passed as mounted volumes. A community Python build, safurrier/mcp-filesystem, runs through uv and became the standard answer for machines where npx misbehaves (r/ClaudeAI, December 2025).

How Do Allowed Directories Work?

Allowed directories are a positional allowlist: each path argument grants access to that directory and everything beneath it, and the server refuses any path outside the list.

A request for /etc/passwd against the config above returns a refusal, not the file. The model can verify its own boundary by calling list_allowed_directories, and that call is the fastest way to confirm a setup change took effect. Three scoping rules keep the boundary meaningful: grant project folders, never your home directory or disk root; keep credential locations (.ssh, .env files, browser profiles) outside every granted tree; and split read-heavy and write-heavy work into separate directories so a wrong write lands somewhere recoverable.

How Do You Set It Up in Each Client?

The config entry above transfers to every JSON-based client; only the file location, root key, and restart behavior change.

• Claude Desktop: the one-click flow above, or the manual entry in claude_desktop_config.json followed by a full quit and relaunch. The walkthrough with paths and errors: set up MCP in Claude Desktop.
• Cursor: the same entry in .cursor/mcp.json at the project root, which scopes the server to that project and travels with the repository.
• VS Code: the same entry in .vscode/mcp.json under the servers root key, not mcpServers.
• Claude Code: one command, no file: claude mcp add filesystem npx -- -y @modelcontextprotocol/server-filesystem /path/to/project.
• Windows: the config lives under %APPDATA%\Claude\, paths use %USERPROFILE% instead of ~, and npx launches need the command wrapper ("command": "cmd", "args": ["/c", "npx", ...]) to avoid execution errors. Machines where npx keeps failing take the uv route above.

Can Claude Read Local Files?

Yes. Claude reads local files through three paths: a direct upload for one file, the Filesystem MCP server for standing directory access, and Claude Desktop’s Attach Folder for one working session.

The Filesystem server is the persistent path. Once configured, every conversation can read, search, and write inside the allowed directories without re-attaching anything, which is what queries like “claude filesystem extension” and “claude desktop file access” are reaching for. The upload and folder paths cover the lighter cases and need no MCP at all; the boundary between them is the subject of the wrong-tool section below.

The same three paths answer the adjacent questions this cluster asks. Can Claude access your file system: yes, inside allowed directories only. Can Claude read files on your computer: yes, through any of the three paths. What Claude cannot do is reach a path you never granted; the refusal is the feature.

The server is connected and the boundary is set. What remains is what to run on it, where the edges sit, and which alternative builds beat it.

What Can You Build with the Filesystem MCP Server?

The dominant workflows are project-folder analysis, draft generation into a directory, and search-and-reorganize jobs.

• Project-folder Q&A: grant a client or codebase folder and ask questions across it. The model chains search_files and read_file calls to answer from the actual documents instead of memory.
• Draft generation in place: the model writes reports, notes, or refactored copies straight into a drafts directory with write_file, so output lands where the work happens rather than in a chat to copy from.
• Folder hygiene: directory_tree plus move_file turns “sort this download folder by project” into one instruction.

Each chained workflow spends 5,000 to 8,000 tokens across its calls on top of the server’s registered definitions, the same budget logic that applies to every connected server.

Is the Filesystem MCP Server Safe?

The server is safe when the allowed-directories list is small and deliberate. The boundary is real, and independent research has probed exactly where it sits.

Security work on the server has concentrated on its directory-access controls (Embrace The Red, August 2025), and path-validation hardening shipped during 2025, including fixes for symlinked paths that pointed outside the allowed list. Two operational rules follow. Run a current version, because an old install carries pre-hardening behavior; the package updates on each npx launch unless a version is pinned. And treat the allowed list as the security boundary it is: no home directory, no disk root, no credential folders, write access only where writes belong. A read-mostly setup that grants one project folder leaves nothing interesting to escape to.

How Does It Compare to the Go and Rust Alternatives?

Pick the reference server by default; pick an alternative when the runtime or the read-only posture is the requirement.

• mark3labs/mcp-filesystem-server (Go) ships as a single binary, which makes it the choice on machines that have no Node.js and no Docker. The tool surface mirrors the reference set.
• rust-mcp-filesystem (Rust) starts read-only until write access is explicitly enabled, a posture that fits research setups where the model has no business writing anything.

The reference server’s advantage is institutional: it is one of the seven active reference implementations, it tracks specification changes as they ship, and its issues land in the main MCP repository. Both alternatives are community-maintained, so the commit-history check decides whether their convenience is worth the maintenance bet.

When Is the Filesystem Server the Wrong Tool?

Skip the server for single files, single sessions, and reference material. Three built-in paths cover those without a config entry:

• Direct upload: one document, one conversation. Drag it into the chat.
• Attach Folder: Claude Desktop’s Cowork view grants a directory for the working session through a permission prompt, the right scope for a one-day project.
• Project knowledge: documents the model needs in every conversation of a project belong there, not behind file reads.

Anthropic’s connector guidance draws the same line: standing OS-level file access belongs to MCP, single tasks belong to uploads (Claude Help Center, April 2026). The server earns its place at the third repeat of the same file workflow.

Filesystem MCP Server Questions

Is the Filesystem MCP Server Free?

Yes. The server is free and open-source under the MIT license. The only cost is the context-window tokens its tool calls consume.

What Is the MCP Tool to Read Files?

read_file reads one file, and read_multiple_files reads a batch in a single call. Both live in the Filesystem server’s tool set and operate only inside allowed directories.

Does the Filesystem Server Work on Windows?

Yes, with two adjustments: %USERPROFILE%-style paths and the cmd /c wrapper around npx. Setups where npx still fails run the uv-based Python build instead.

Does Anthropic Maintain the Filesystem Server?

Yes. Anthropic built it, and the MCP project under the Linux Foundation now maintains it as one of the seven active reference servers. It is not archived; the thirteen archived reference servers are a different list, and this server tracks current specification releases.

Every capability on this page runs inside the first decision you make: the directories you pass as arguments. Choose those two paths well, and the rest is one restart away.