# Filesystem — MCP Server

> Give an AI agent scoped read and write access to local files.

**Source:** https://mcpplaygroundonline.com/mcp-servers/filesystem  
**Transport:** stdio  
**Requires auth:** No

---

## What it does

The filesystem MCP server exposes local file operations as tools with a directory allowlist enforced on every call. You pass allowed paths as command-line arguments, or supply them dynamically through Roots, and any operation outside those paths is refused. Inside them, a model can read and write files, create directories, move and rename, search by pattern and read file metadata. Media handling is worth knowing about: image and audio files are streamed back as base64 with the right MIME type, so a model can actually look at a screenshot rather than being handed a byte count. It runs over stdio via npx, with no service to sign up for.

## Tools exposed

- read_file / read_multiple_files — read contents, with media returned as typed content
- write_file — create or overwrite a file within an allowed directory
- edit_file — apply line-based edits and return a diff
- create_directory / move_file — manage the directory tree
- list_directory / directory_tree — enumerate contents recursively
- search_files — find files by glob pattern
- get_file_info — size, timestamps and permissions
- list_allowed_directories — show exactly what the server may touch

## Example queries you can run

- "Read every markdown file in ./docs and list which ones have no front matter."
- "Find all TODO comments under ./src and group them by file."
- "Rename these screenshots to match the pattern in the folder README."
- "Summarise what changed between config.old.json and config.json."

## Details

- **Recommended model:** anthropic/claude-sonnet-4.5 — Sonnet 4.5 handles multi-file reading and line-based edits accurately, which matters when a wrong edit_file call silently corrupts a source file.
- **Transport:** stdio
- **Authentication:** Not required — No credentials. Access is controlled entirely by the directory allowlist you pass on the command line or through Roots.
- **Official source:** [Filesystem MCP Server — official reference implementation](https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem)

## Frequently asked questions

### What is the filesystem MCP server?

It is the official reference server from the Model Context Protocol project, published as @modelcontextprotocol/server-filesystem. It gives a model read and write access to directories you explicitly allow, and refuses any operation outside them.

### How do I limit which directories the agent can access?

Pass allowed directories as command-line arguments, for example npx -y @modelcontextprotocol/server-filesystem /path/to/project. Clients that support Roots can also supply them dynamically. The list_allowed_directories tool shows exactly what is in scope at any moment.

### Can the filesystem MCP server read images?

Yes. Image and audio files are returned as base64 with the matching MIME type rather than as raw bytes, so a model can genuinely inspect a screenshot or listen to a clip instead of just seeing a file size.

### Is it safe to give an AI model write access to my files?

The allowlist is a real boundary, but inside it the agent can overwrite files. Point it at a project directory under version control rather than your home folder, so any bad edit is one git diff away from being undone.

### Why is the filesystem server stdio rather than hosted?

It operates on your local disk, so there is nothing to host — the server has to run on the machine holding the files. That is also why it needs no credentials: the security boundary is the directory allowlist, not an API key.

---

_Test this server across 40+ models on MCP Playground: https://mcpplaygroundonline.com/mcp-servers/filesystem — free, no install._