Filesystem MCP Server: Setup and Security Risks

Q: How do I add the Filesystem MCP server to Claude Desktop?

Add a filesystem entry to claude_desktop_config.json, with npx as the command and -y, @modelcontextprotocol/server-filesystem and your folders as the args. You need Node.js 24 or later. On Windows, the README uses "command": "cmd" and puts "/c", "npx" at the start of args.

Q: Is the Filesystem MCP server official?

Yes. It's a reference server in the modelcontextprotocol/servers repo, published on npm as @modelcontextprotocol/server-filesystem.

Q: How do I make the Filesystem MCP server read-only?

Add --read-only to the arguments, on version 2.2.0 or later. Write tools then aren't registered at all. In Docker, you can also add ,ro to the mount, so the operating system enforces it as well.

Q: Can I block .env or other files inside an allowed folder?

The README describes no way to do that. excludePatterns only applies to search_files and directory_tree, and it doesn't stop a read. Move secrets out of the folder, or allow a narrower one.

Q: Can the Filesystem MCP server search inside files?

No. search_files matches file and folder names against a glob, and never reads contents. The model has to read a file to see what's in it.

On this page

Filesystem MCP Server: Setup, Read-Only Mode and Security Risks (Nov 2026)

The Filesystem MCP server is the official reference server that lets an AI client read, write, move and search files in folders you name. Run 2.2.0 or later, allow one project folder, and add --read-only unless it must write. TrustedMCP grades it D.

The D doesn't mean abandoned: this server is very actively maintained. It comes from three things you can plan around: no login, one advisory still open on Windows, and stdio-only transport.

How we checked: on 2026-11-07 we read the README, the source, the npm metadata, Docker Hub, and every advisory listed for the repo. We didn't install or run it.

What the Filesystem MCP server can do

The npm package is @modelcontextprotocol/server-filesystem, version 2.2.0 at the time of writing. It has 15 tools, plus read_file as a deprecated alias of read_text_file.

Tools	What they do	With `--read-only`
`read_text_file`, `read_media_file`, `read_multiple_files`	Read file contents	Kept
`list_directory`, `list_directory_with_sizes`, `directory_tree`	List folders	Kept
`search_files`	Find files by name, not by what's in them	Kept
`get_file_info`, `list_allowed_directories`	Show metadata and the folders it can reach	Kept
`create_directory`, `append_file`, `copy_file`	Add folders, files and text	Removed
`write_file`, `edit_file`, `move_file`	Overwrite, change or relocate files	Removed

There's no delete tool. That doesn't make your files safe, because write_file can overwrite a file with anything and move_file removes the source. Use Git or backups in any folder this server can write to.

How to set up the Filesystem MCP server

You need Node.js 24 or later for npx. The README says the server is MIT licensed.

Claude Desktop. Add this to claude_desktop_config.json, using your own paths:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/Desktop",
        "/path/to/other/allowed/dir"
      ]
    }
  }
}

On Windows, the README uses "command": "cmd" and puts "/c", "npx" at the start of args. Write backslashes in JSON paths as \\.

VS Code. Add this to your user mcp.json (run MCP: Open User Configuration) or to .vscode/mcp.json:

{
  "servers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "${workspaceFolder}"
      ]
    }
  }
}

Claude Code and Cursor. The README has no snippet for these, so these are our translations, and we haven't run them. Claude Code:

claude mcp add --transport stdio filesystem \
  -- npx -y @modelcontextprotocol/server-filesystem /absolute/path/to/project

Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/absolute/path/to/project"]
    }
  }
}

More on each client: Claude Code MCP setup and VS Code MCP setup.

Check which version you're running

This trips up anyone who has used the server for a while. The package moved from date versions such as 2026.8.31 to normal version numbers. The advisory warns that package managers rank 2.0.1 below every 2025.x and 2026.x version, so they won't offer it as an upgrade and Dependabot won't open a pull request.

The date versions are deprecated on npm, and the advisories list no fix for them. If you installed one, upgrade by hand:

npm install @modelcontextprotocol/server-filesystem@latest

If you use npx, you can name the version in your config, as @modelcontextprotocol/server-filesystem@2.2.0. Then you know what runs, and you choose when it changes.

Lock it down: read-only mode, Roots and folders

Allow the smallest folder that does the job. Never allow your home folder or a drive root. Everything inside an allowed folder is open to the model, including .env files, and the README describes no way to block single files.

Add --read-only if the AI only needs to look. The server then doesn't register any tool that writes, so a client never sees those tools and a call to one fails as an unknown tool. Add the flag before the folders. The JSON form below is our translation of the README's command line:

"args": [
  "-y",
  "@modelcontextprotocol/server-filesystem",
  "--read-only",
  "/path/to/project"
]

The flag applies to every allowed folder. To protect only some of them, run two servers, one with the flag and one without. Read the next point first, because Roots can undo that split.

Add --confine-roots if your client uses Roots. Roots is a deprecated feature that lets a 2025-era client tell the server which folders to use. By default those Roots replace the folders on your command line, so a client can point the server somewhere you didn't list. With --confine-roots, Roots can only narrow your list. On a connection using the current 2026-07-28 protocol, Roots aren't used at all.

Check what it can reach. Ask the model to call list_allowed_directories. The server also logs the effective folders to stderr, and says where they came from.

Docker: build the image yourself

The README's Docker setup mounts folders under /projects, and adding ,ro to a mount makes it read-only:

"--mount", "type=bind,src=/path/to/project,dst=/projects/project,ro",

This is a strong limit, because the server can only see what you mounted and the operating system enforces ro.

But don't pull the published image and assume it's current. On Docker Hub, mcp/filesystem showed its newest tag pushed in September 2025, more than a year before the 2.0.1 fixes. It can't include those fixes or --read-only. Build it from the repo root with the README's command:

docker build -t mcp/filesystem -f src/filesystem/Dockerfile .

To cut the tool list from the client side as well, see how to limit MCP tools.

Filesystem MCP server security advisories

The repo has published six advisories for this server, all about getting outside the allowed folders. Five are fully fixed. One is still open on Windows.

Advisory	Severity	The problem	Status
CVE-2025-53109	High	Symlinks reach files outside	Fixed (2025.7.1)
CVE-2025-53110	High	A sibling folder with the same name prefix passes the check	Fixed (2025.7.1)
GHSA-4gxg-m5jx-9j57	Medium	Different letter case in a symlink's name creates files outside	Fixed (2.0.1)
GHSA-7rgq-gccq-qphx	Medium	A trailing quote or space reaches a sibling folder	Fixed (2.0.1)
GHSA-hhwq-wxfx-cj7g	Low	`list_directory_with_sizes` reveals the size of files outside	Fixed (2.0.1)
GHSA-53mr-w429-c597	Low	A folder swapped for a link between the check and the write sends the write outside	Fixed on Linux and macOS (2.0.1). Open on Windows

The four advisories from 2026 were published on 25 October, the same day 2.0.1 reached npm. Version 2.2.0 (4 November) also moves minimatch off a release line with a denial-of-service bug (GHSA-g3hv-75wg-m249), and search patterns from the client reach that code. So use 2.2.0, not just 2.0.1.

The open Windows gap

On Windows, Node.js can't tie a write to the folder the server just checked. If a folder on the path is swapped for a junction at the right moment, write_file, edit_file, create_directory and the destination of move_file can land outside the allowed folders. The advisory notes that creating a junction needs no special privilege.

A real fix needs native code, which the maintainers haven't decided how to ship. The issue is still open, and its milestone has moved from v2.2.0 to v2.5.0.

What to do on Windows:

Follow the advisory: don't allow a folder that another user or an untrusted local process can write to.
Use --read-only where you can. It removes all four of those tools, so this particular gap has nothing to act through.

The race also needs something else on your machine changing that folder at the right moment, which is why the advisory rates it low.

Hard links are a known limit

The server checks the path you pass, not every name a file has. If a file in an allowed folder is hard-linked from elsewhere, editing it changes it at both names. The README gives pnpm's node_modules as a real example. get_file_info shows a hardLinks count, and more than 1 means the file has other names.

The bigger risk: prompt injection and what the model reads

Path bugs get the CVEs, but most people's real exposure is simpler. The server does exactly what the model asks, inside the folders you allowed.

Files can carry instructions. A README, an issue export or a downloaded document can include text aimed at the model. That's prompt injection. With write tools on, that text can try to change your code or config.

Reading plus sending is the dangerous pair. On its own this server has no way to send data over the network. Pair it with a server that can, such as the Fetch MCP server, and a planted instruction could try to read .env and post it somewhere. Whatever the model reads also goes to your AI provider. Keep secrets out of allowed folders.

Hints aren't controls. The tools carry MCP tool annotations that mark write_file, edit_file and move_file as destructive, but your client decides what to do with them. edit_file has a dryRun option, and the README says to use it first. Keep approval prompts on for writes.

For a general check of any server, see is this MCP server safe to install? and the MCP Inspector guide.

Filesystem MCP server troubleshooting

What you see	Likely cause	What to do
Server exits straight away, status 1	No folders given, and your client doesn't support Roots	Add at least one folder to `args`
Every call fails, saying no folders are allowed	The client's Roots were withdrawn, or a 2026-07-28 client connected with none on the command line	Add folders to `args`, then check `list_allowed_directories`
`Access denied` on a path you expected to work	Roots replaced your folders, or a symlink points outside	Check `list_allowed_directories` and the stderr log
`Filesystem call timed out after 15000 ms`	A slow cloud or network folder	Narrow `path`, or name the folder in `excludePatterns`
`stopped after visiting 100000 entries`	A very large tree	Narrow `path`, exclude big folders, or set `depth` on `directory_tree`
Write tools are missing	`--read-only` is on	Remove the flag if you need writes
`search_files` can't find text you know is there	It matches names, not contents	Search names, then read the file

For general connection errors, see MCP server not working.

Other filesystem MCP servers: check the package name

Many servers have "filesystem" in their name, and this guide and our grade cover only @modelcontextprotocol/server-filesystem. For example, NVD lists CVE-2025-67366, a critical path traversal in version 0.5.8 of a different package, @sylphxltd/filesystem-mcp. Read the exact name before you install.

How we graded it

Check	Result	Why
Authentication	None	No login. It runs on your machine as your user, and that's common for stdio servers, but nothing limits who can steer it
Maintenance	Top band	Several releases in the past month, and more than one maintainer active in the repo. But all 152 human commits to this server's folder in the past 60 days came from one person
Known CVEs	One open, with a mitigation	The Windows part of GHSA-53mr is open. The advisory documents what to do
Transport safety	Good for local use	stdio only, and we found no shell-out in the source

That adds up to a D. The two things that moved it there are the missing login and the open Windows advisory. If the Windows gap closes, the grade goes back up to C. See how we score servers. Grades come from public data and aren't an audit.

Need file access with real sign-in, per-user permissions and an audit trail? We build custom MCP servers. Tell us what you need to connect.

Frequently asked questions

What is a file system MCP server?

It's an MCP server that gives an AI client tools to work with files on your machine. The official one is @modelcontextprotocol/server-filesystem, which can read, write, move and search files in folders you name. Many other servers have "filesystem" in their name, so read the exact package name before you install.

How do I add the Filesystem MCP server to Claude Desktop?

Add a filesystem entry to claude_desktop_config.json, with npx as the command and -y, @modelcontextprotocol/server-filesystem and your folders as the args. You need Node.js 24 or later. On Windows, the README uses "command": "cmd" and puts "/c", "npx" at the start of args.

Is the Filesystem MCP server safe to use?

It's reasonable for a single project folder with version 2.2.0 or later, especially with --read-only. TrustedMCP grades it D because it has no login and one advisory is still open on Windows. The bigger day-to-day risk is prompt injection from the files it reads, so keep secrets out of allowed folders.

Is the Filesystem MCP server official?

Yes. It's a reference server in the modelcontextprotocol/servers repo, published on npm as @modelcontextprotocol/server-filesystem.

Can the Filesystem MCP server access files outside allowed folders?

It's designed not to, and it resolves symlinks and refuses any that point outside. Six advisories have found ways around that check in the past. Five are fixed, the sixth is still open on Windows, and hard links remain a documented limit.

Can the Filesystem MCP server delete files?

It has no delete tool. It can still destroy content, because write_file overwrites a file in place and move_file removes the source. A crash during a write can also leave a partly written file, so keep backups.

How do I make the Filesystem MCP server read-only?

Add --read-only to the arguments, on version 2.2.0 or later. Write tools then aren't registered at all. In Docker, you can also add ,ro to the mount, so the operating system enforces it as well.

Can I block .env or other files inside an allowed folder?

The README describes no way to do that. excludePatterns only applies to search_files and directory_tree, and it doesn't stop a read. Move secrets out of the folder, or allow a narrower one.

Can the Filesystem MCP server search inside files?

No. search_files matches file and folder names against a glob, and never reads contents. The model has to read a file to see what's in it.