Verified MCP server: Filesystem

The filesystem MCP server, verified live on a real Mac.

  • Verified2026-08-02macOS 14.4.1
  • Package@modelcontextprotocol/server-filesystem 2026.7.10
  • Self-reportedsecure-filesystem-server 0.2.0
  • MCP protocol2025-06-18
  • Nodev25.8.1

The short answer

Last verified 2026-08-02

The filesystem MCP server gives an AI assistant read and write access to the folders you choose, and refuses everything outside them. It is the reference file server of the Model Context Protocol project, it runs on your own Mac over stdio, and it needs no account, no API key, and no sign-up of any kind. We did not take the README's word for any of that: we ran the server, spoke the protocol to it, enumerated every tool it exposes, and kept the raw output, including the exact errors it returns when something goes wrong. All of it is on this page. [1][3][6]

  • Tools

    14, enumerated live

  • Credentials

    None needed

  • Transport

    stdio, runs on your Mac [6]

  • Maintainer

    modelcontextprotocol [1][3]

  • Downloads

    385k last week [2]

  • License

    MIT to Apache-2.0 [4]

Verification

How this MCP server was verified.

Method

We spawned the server with npx over stdio with one allowed folder, completed the MCP initialize handshake, called tools/list, and ran one real tool call. The raw JSON was captured on the wire, and the tool table below is that capture, word for word.

Startup banner

Secure MCP Filesystem Server running on stdio
Client does not support MCP Roots, using allowed directories set from server args: [ '/tmp', '/private/tmp' ]

One real tool call

tools/call list_directory {"path": "/tmp"}
[FILE] build.log
[DIR] claude-502
[DIR] com.apple.launchd.ugMEiOmS7E

Real lines from the captured result: enough to prove the call answered.

Tools

Every tool, enumerated from the running server.

The server answered tools/list with 14 tools on 2026-08-02. The names, descriptions and parameters below are its own words, copied from that response and never edited.

ToolWhat it does
read_fileDeprecatedpath*tailhead

Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead.

read_text_filepath*tailhead

Read the complete contents of a file from the file system as text. Handles various text encodings and provides detailed error messages if the file cannot be read. Use this tool when you need to examine the contents of a single file. Use the 'head' parameter to read only the first N lines of a file, or the 'tail' parameter to read only the last N lines of a file. Operates on the file as text regardless of extension. Only works within allowed directories.

read_media_filepath*

Read a file and return it as a base64-encoded content block with its MIME type. Image and audio files are returned as image/audio content; any other file type is returned as an embedded resource. Only works within allowed directories.

read_multiple_filespaths*

Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when you need to analyze or compare multiple files. Each file's content is returned with its path as a reference. Failed reads for individual files won't stop the entire operation. Only works within allowed directories.

write_filepath*content*

Create a new file or completely overwrite an existing file with new content. Use with caution as it will overwrite existing files without warning. Handles text content with proper encoding. Only works within allowed directories.

edit_filepath*edits*dryRun

Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git-style diff showing the changes made. Only works within allowed directories.

create_directorypath*

Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. If the directory already exists, this operation will succeed silently. Perfect for setting up directory structures for projects or ensuring required paths exist. Only works within allowed directories.

list_directorypath*

Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is essential for understanding directory structure and finding specific files within a directory. Only works within allowed directories.

list_directory_with_sizespath*sortBy

Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is useful for understanding directory structure and finding specific files within a directory. Only works within allowed directories.

directory_treepath*excludePatterns

Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (file/directory), and 'children' for directories. Files have no children array, while directories always have a children array (which may be empty). The output is formatted with 2-space indentation for readability. Only works within allowed directories.

move_filesource*destination*

Move or rename files and directories. Can move files between directories and rename them in a single operation. If the destination exists, the operation will fail. Works across different directories and can be used for simple renaming within the same directory. Both source and destination must be within allowed directories.

search_filespath*pattern*excludePatterns

Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns that match paths relative to the working directory. Use pattern like '*.ext' to match files in current directory, and '**/*.ext' to match files in all subdirectories. Returns full paths to all matching items. Great for finding files when you don't know their exact location. Only searches within allowed directories.

get_file_infopath*

Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creation time, last modified time, permissions, and type. This tool is perfect for understanding file characteristics without reading the actual content. Only works within allowed directories.

list_allowed_directories

Returns the list of directories that this server is allowed to access. Subdirectories within these allowed directories are also accessible. Use this to understand which directories and their nested paths are available before trying to access files.

Parameters marked with * are required.

Setup

Working configs, one per app.

Copy the block for the app you use. Each one is the configuration this server was verified with.

Claude Desktop

Open the file ~/Library/Application Support/Claude/claude_desktop_config.json (in Claude Desktop: Settings, then Developer, then Edit Config) and add:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourname/Documents"
      ]
    }
  }
}

Replace the folder path with the ones you want to allow (you can list several), then quit and reopen Claude Desktop. [7]

Claude Code

One command in your terminal:

claude mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem ~/Documents

Everything after the double dash is the exact command Claude Code will run. Swap ~/Documents for the folder you want to allow. [8]

Cursor

Add to ~/.cursor/mcp.json for every project, or to .cursor/mcp.json inside one project:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourname/Documents"
      ]
    }
  }
}

Cursor picks the file up on restart. [9]

Routines

No JSON file and no terminal. In Routines: Settings, then Assistant, then Connections, then Add MCP Server. Switch the form to Command (stdio) and enter:

Name        Filesystem
Command     npx
Arguments   -y @modelcontextprotocol/server-filesystem /Users/yourname/Documents

The Arguments field splits on spaces, so use a full folder path with no spaces in it, starting with /Users. Click Test Connection first: a working server answers with its tool count. [10]

No terminal needed

Set the Filesystem MCP server up without the terminal.

If you have never opened Terminal and never want to, this is your path. Routines is a Mac app that runs MCP servers for you: fill in three fields once, and this server's tools are available to your AI in chat and in scheduled routines.

  1. 01

    Install Routines

    Download the app from getroutines.ai/download, drag it to Applications, and sign in.

  2. 02

    Open the MCP settings

    Click your account at the bottom of the sidebar and choose Settings. Open the Assistant section, then the Connections tab, scroll to MCP Servers, and click Add MCP Server.

  3. 03

    Choose Command (stdio)

    If this is your first MCP server, there is a Quick Add row with a Filesystem preset that fills the whole form for you. Otherwise switch the form to Command (stdio): this server is a command, not a web address.

  4. 04

    Point it at one folder

    Name: Filesystem. Command: npx. Arguments: -y @modelcontextprotocol/server-filesystem followed by a space and the full path of the folder to allow, like /Users/yourname/Documents. Write the path in full, starting with /Users, with no spaces in it.

  5. 05

    Test, then add

    Leave Environment Variables empty, this server needs none. Click Test Connection: Routines starts the server and reports how many tools it found, fourteen for this one. Then click Add Server.

  6. 06

    Use it

    The tools work in chat right away. To let a scheduled routine use them, open the routine, find the Tools & connections card, and tick the server under Apps.

Routine ideas

Routines worth scheduling.

Once the server is connected, a scheduled routine can use its tools while you are away. Copy a prompt, paste it into Routines, and pick a time.

A Friday files report

Prompt

Every Friday at 16:00, look through my Documents folder, list every file added this week with a one-line note on what it is, and save the list as weekly-files.md in that same folder.

A Downloads janitor

Prompt

Every Monday at 9:00, list everything in my Downloads folder with sizes, flag anything larger than 500 MB or untouched for 30 days, and write the list to downloads-review.md so I can decide what to delete.

An evening notes tidy-up

Prompt

Every evening at 18:30, read the files changed today in my Notes folder, add a one-line summary to the top of each file that has none, and save the changes.

Troubleshooting

The errors we hit, and what fixed them.

Real errors captured during the verification run, printed exactly as the server returned them.

The server starts but seems stuck

What you see

Usage: mcp-server-filesystem [allowed-directory] [additional-directories...]
Note: Allowed directories can be provided via:
  1. Command-line arguments (shown above)
  2. MCP roots protocol (if client supports it)
At least one directory must be provided by EITHER method for the server to operate.
Secure MCP Filesystem Server running on stdio
Started without allowed directories - waiting for client to provide roots via MCP protocol

The fix

You started it with no folder argument. The current version does not exit: it prints this note and waits for the client to supply folders over the MCP roots protocol, which not every client supports (our test client did not). Add at least one folder path after the package name and restart it.

Access denied on a folder you did not list

What you see

Access denied - path outside allowed directories: /etc not in /tmp, /private/tmp

The fix

Working as designed: the server refuses every path outside the folders you listed at startup. We triggered this on purpose by asking for /etc while only /tmp was allowed. Either ask about a path inside an allowed folder, or add the folder to the arguments and restart. On a Mac it resolves symlinks for you, which is why allowing /tmp also allowed /private/tmp.

ENOENT when reading a file

What you see

ENOENT: no such file or directory, open '/private/tmp/definitely-does-not-exist-mcp-verify-2026.txt'

The fix

The path does not exist: usually a typo, a renamed file, or a folder prefix that is not quite right. Ask the assistant to run list_directory on the parent folder first and pick the file from the listing.

Your MCP client cannot start the server at all

The fix

The npx command belongs to Node.js. If Node is not installed on your Mac, every client on this page fails at the spawn step before the server can say anything. Install Node from nodejs.org, restart your MCP client, and try again.

FAQ

Questions people ask.

What is the filesystem MCP server?

It is the reference file-access server of the Model Context Protocol project. Once connected, an AI assistant such as Claude can read, search, edit, and organize files inside the folders you explicitly allow, and nothing outside them. It runs as a local process on your Mac and talks to your AI app over stdio. [5][6]

What tools does the filesystem MCP server include?

The running server exposes 14 tools: reading (read_text_file, read_media_file, read_multiple_files, plus the deprecated read_file), writing and editing (write_file, edit_file), folders (create_directory, list_directory, list_directory_with_sizes, directory_tree, move_file), search (search_files), and metadata (get_file_info, list_allowed_directories). The table above is the live tools/list output, word for word.

Is the filesystem MCP server safe?

It is sandboxed to the folders you list when you start it, and we verified the fence: asking it for /etc while only /tmp was allowed returned an access-denied error, which is printed in the troubleshooting section above. The real risk is scope: write_file overwrites without warning, so allow one specific folder, not your whole home directory, and widen access only when a task needs it.

Do I need the terminal to set it up?

No. In Routines you fill three fields in Settings and click Test Connection; the walkthrough above shows every click. Claude Desktop needs a small JSON file edited once. Only Claude Code is terminal-first by nature. [10][7]

Does it need an API key or an account?

No. There is nothing to sign up for and no credential to paste: this is why it is the easiest MCP server to try first. The npx command downloads the package from the public npm registry on first run, so the very first start needs an internet connection; after that the package is cached on your Mac. [1]

Why does npm say version 2026.7.10 but the server reports 0.2.0?

Both numbers are real and we captured both. The npm release pipeline stamps a date-based version at publish time, so the registry says 2026.7.10. Over MCP, the running server self-reports its internal name and version, secure-filesystem-server 0.2.0. Same code, two version schemes. [1]

Which apps can use the filesystem MCP server?

Any MCP client that can launch a local stdio server: Claude Desktop, Claude Code, Cursor, and Routines all can, and the exact config for each is above. The server itself is the same in every client; only the place you paste the config differs. [7][8][9][10]

Sources

Every external claim, receipted.

Anything on this page we did not observe in the run is linked here, with the date we read it. The run itself is the receipt for the rest.

  1. [1]

    npm registry: @modelcontextprotocol/server-filesystemaccessed 2026-08-02

    Latest version 2026.7.10, published 2026-07-10.

  2. [2]

    npm downloads API: last weekaccessed 2026-08-02

    385,247 downloads for the week ending 2026-08-01.

  3. [3]

    GitHub: modelcontextprotocol/serversaccessed 2026-08-02

    89,138 stars and a push dated 2026-08-02 at access time, per the GitHub API.

  4. [4]

    modelcontextprotocol/servers LICENSE fileaccessed 2026-08-02

    The project states it is transitioning from the MIT License to Apache-2.0; docs are CC-BY-4.0.

  5. [5]

  6. [6]

    Filesystem server source: index.tsaccessed 2026-08-02

    Instantiates StdioServerTransport: the server speaks stdio.

  7. [7]

    modelcontextprotocol.io: Connect to local MCP serversaccessed 2026-08-02

    The official Claude Desktop quickstart; its example server is this one.

  8. [8]

    Claude Code docs: MCPaccessed 2026-08-02

    The claude mcp add syntax for local stdio servers.

  9. [9]

    Cursor docs: Model Context Protocolaccessed 2026-08-02

    The mcp.json shape and file locations.

  10. [10]

    Routines: Connectorsaccessed 2026-08-02

    How Routines runs one-click OAuth connectors and any MCP server.

This page describes Filesystem as it behaved in one dated run on one Mac. Versions move: if something here no longer matches what you see, the capture date at the top says how old the reading is.

Behind this directory

Routines, the app behind this directory, runs MCP servers like this one without a terminal: see how connectors work. Your notes stay markdown files on your Mac, there is no cloud bill, and it works offline. Download Routines