Filesystem

Published as @modelcontextprotocol/server-filesystem. Pass one or more absolute directories as arguments. That list is the access control. A client that still speaks the older Roots feature can swap directories at runtime, but Roots is deprecated in the 2026-07-28 protocol, so the command-line list is the one to set.

The package asks for Node.js 24 or later when you launch it with npx. This server has had path-bypass fixes before. Keep it updated, and do not point it at a home directory unless you mean that.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/absolute/path/you/allow"]
    }
  }
}