Is the Filesystem MCP safe to use?

Yes. The allowed directories you pass on the command line are the only paths the server will read or write. Requests that try to traverse outside those roots (including via symlinks or `..` segments) are rejected at the path-normalization layer before any filesystem call is made.

Can it write files, or is it read-only?

Read and write are bundled together — once a directory is allowed, the server can create, overwrite, move, and delete files inside it. If you need read-only, either mount the directory read-only at the OS level or run the server inside a sandbox (e.g. macOS App Sandbox, Linux bind-mount).

Does it work with Cursor and VS Code as well as Claude Desktop?

Yes. Every MCP-compatible client (Claude Desktop, Cursor, VS Code, Windsurf, Cline, Continue, Zed) speaks the same stdio protocol. The install snippets on this page cover each of them.

What happens if I do not pass an allowed directory?

The server refuses to start. Unlike some shell tools it has no "current working directory" default — an explicit allow-list is required, which is the key safety property that makes it suitable to run as an agent tool.

How do I give the agent access to multiple project folders?

Pass each path as a positional argument after the package name. For example: `npx -y @modelcontextprotocol/server-filesystem ~/code/project-a ~/code/project-b`. The server treats each as an independent allowed root.

Can two MCP clients share a single Filesystem server?

No — each client launches its own process over stdio and does not multiplex connections. If Claude Desktop and Cursor are both running, each has its own Filesystem process. Performance is not affected since each is I/O-bound on its own agent.

Filesystem

Name: Top MCPs — curated MCP directory
Creator: Top MCPs
License: https://creativecommons.org/licenses/by/4.0/

Official

Read and write local files with configurable access controls.

Score 96(?)Anthropic (modelcontextprotocol)MIT 90kVerified Aug 19, 2026Top MCPs for Filesystem & Storage →

Install View on GitHub

Quick answer

What it does

Provides read/write access to local files and directories within configurable path boundaries. Supports listing, reading, writing, and moving files.

Best for

Reading and editing local code
Generating files from AI output
Navigating project structures
Config file management

Not for

Remote file systems
Cloud storage access

Source: top-mcps.com/mcp/filesystem — verified Aug 2026

Setup recipe

Pick your client, then follow the three steps.

Install

claude_desktop_config.jsonjson

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/allowed/dir"
      ]
    }
  }
}

Paste under mcpServers. Fully quit and reopen Claude after editing.

CLI or .mcp.jsonshell

claude mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem /path/to/allowed/dir

Run from your repo. Commit .mcp.json to share with your team.

.cursor/mcp.jsonjson

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/allowed/dir"
      ]
    }
  }
}

Global path: ~/.cursor/mcp.json. Reload window after editing.

.vscode/mcp.jsonjsonc

{
  "servers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/allowed/dir"
      ]
    }
  }
}

VS Code uses the "servers" key (not "mcpServers").

~/.codeium/windsurf/mcp_config.jsonjson

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/allowed/dir"
      ]
    }
  }
}

Open via Cascade → hammer icon → Configure.

cline_mcp_settings.jsonjson

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/allowed/dir"
      ]
    }
  }
}

Open via the Cline sidebar → MCP Servers → Edit.

~/.continue/config.jsonjson

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "npx",
          "args": [
            "-y",
            "@modelcontextprotocol/server-filesystem",
            "/path/to/allowed/dir"
          ]
        }
      }
    ]
  }
}

Continue uses modelContextProtocolServers with a transport block.

~/.codex/config.tomlshell

# ~/.codex/config.toml
[mcp_servers.filesystem]
command = "npx"
args = [
  "-y",
  "@modelcontextprotocol/server-filesystem",
  "/path/to/allowed/dir",
]

Codex uses TOML. Each server is a [mcp_servers.<name>] subtable.

~/.config/zed/settings.jsonjsonc

{
  "context_servers": {
    "filesystem": {
      "command": {
        "path": "npx",
        "args": [
          "-y",
          "@modelcontextprotocol/server-filesystem",
          "/path/to/allowed/dir"
        ]
      }
    }
  }
}

Zed calls them "context_servers". Settings live-reload on save.

ChatGPT → Apps directorynone

Filesystem doesn't ship a hosted HTTPS endpoint today. ChatGPT supports remote MCP servers only — to use this server in ChatGPT you'll need to deploy it to a public HTTPS URL first (e.g. via Cloudflare Workers or Vercel) or wait for an official remote build.

2
Set required secrets
No credentials required — this MCP runs over stdio without authentication.
3
Try a minimum working prompt
Prove the install works by grouping TODOs in your repo
List every TODO comment under ~/code/project-a (recursively) and group them by file, showing the matching line for each.
Tested with: Claude Desktop, Cursor, VS Code.

Tools & permissions

Tool	Description	Args	Side effects
`read_file`	Read the full contents of a file within an allowed directory.	path: string	Read
`read_multiple_files`	Read several files in one call.	paths: string[]	Read
`write_file`	Create or overwrite a file.	path: string, content: string	Write
`edit_file`	Apply a search-and-replace edit to an existing file.	path: string, edits: object[]	Write
`create_directory`	Create a new directory (and parents) within an allowed root.	path: string	Write
`list_directory`	List the entries of a directory.	path: string	Read
`directory_tree`	Return a recursive tree of a directory.	path: string	Read
`move_file`	Move or rename a file.	source: string, destination: string	Write
`search_files`	Recursively search for files by pattern.	path: string, pattern: string	Read
`get_file_info`	Return size, timestamps, and type for a file.	path: string	Read
`list_allowed_directories`	Return the directory roots the server was started with.	—	Read

Security & scope

Access scope: Read + write
Sandbox: Runs as a child process over stdio. Access is restricted to the directory roots passed on the command line; path traversal via `..` or symlinks outside those roots is rejected at the path-normalization layer before any filesystem call is made.
Gotchas: Without at least one allowed-directory argument, the server refuses to start — there is no implicit current-working-directory default.
Read and write are bundled; for read-only access you must mount the directory read-only at the OS level or run the server in a sandbox.

Agent prompt pack

— copy into Claude, Cursor, or ChatGPT.

Paste into Claude, Cursor, or ChatGPT. Edit the [brackets] before sending.

Recommend the best MCP servers for [task: e.g. filesystem & storage work] in [client: Claude].

Constraints:
- Prefer tools that are [official | open-source | read-only] — pick what matters for my use case.
- Exclude MCPs that require [e.g. a paid plan, OAuth-only flows, remote-only transport].
- Return at most 3 picks, ranked.

For each pick include:
1. One-sentence rationale.
2. The ready-to-paste install snippet for my client.
3. Any required secrets I need to create before installing.

Cross-check the top-mcps.com listing: https://top-mcps.com/top-mcps-for-filesystem-storage

Compare Filesystem against a real alternative. Swap the second MCP in [brackets] if you want a different match.

Compare Filesystem MCP vs [GitHub MCP] for the following job: [describe the job, e.g. "let an agent create GitHub issues on bug triage"].

Judge them on:
- Setup time and complexity (what a new user hits first).
- Auth model (none / API key / OAuth 2.1) and credential risk.
- Transport (stdio / Streamable HTTP / SSE) and where the server runs.
- Required secrets and the blast radius if they leak.
- Operational risk in an unattended agent loop.
- Which one is "good enough" for a weekend prototype vs. production.

End with one sentence: which should I pick for my scenario, which is: [my scenario].

References:
- https://top-mcps.com/mcp/filesystem
- top-mcps.com listing for GitHub

Asks the agent to install and verify. Works inside Claude Code, Cursor Agent, Codex CLI.

Install the Filesystem MCP server for my [client: Claude] at the default config path for that client.

Use the exact install snippet published at https://top-mcps.com/mcp/filesystem (fetch https://top-mcps.com/mcp/filesystem.json for the canonical server.json if you can read URLs).

Before finishing:
1. Create the required secrets (no secrets) and put them in the appropriate env block — do not hard-code them.
2. Restart or reload the client so it picks up the new server.
3. Verify the server is connected (green / running state) and at least one tool is listed.
4. If anything fails, read the client's MCP logs and report the exact error — do not silently retry.

Confirm when done and list the tools the server now exposes.

Frequently asked questions

What changed

— 3 updates tracked.

Jan 27, 2026
2026.1.26 released — Release 2026.1.26
Jan 14, 2026
2026.1.14 released — Release 2026.1.14
Dec 18, 2025
2025.12.18 released — Release 2025.12.18

At a glance

Maintainer: Anthropic (modelcontextprotocol)
Transport: stdio
Auth model: None
Required secrets: None
Supported clients: ChatGPT
Claude Desktop
Claude Code
Cursor
VS Code
Windsurf
Cline
Continue
Zed
Codex CLI
License: MIT
Language: TypeScript
Latest version: latest
Last verified: Aug 19, 2026

GitHub repo

Rank badge

Maintainer of Filesystem? Embed the live badge — it re-renders with the current rank and score on every catalog refresh.

[![Ranked #1 in Filesystem & Storage on Top-MCPs](https://top-mcps.com/badge/filesystem.svg)](https://top-mcps.com/mcp/filesystem)

Alternatives

GitHub →
Full GitHub API access: repos, PRs, issues, and code search.
Dropbox →
Dropbox — official ChatGPT Apps directory listing, verified for 2026.
Box →
Browse, search, and Q&A across Box content from an AI agent — official remote MCP.

Related guides

More Filesystem & Storage MCPs

Other tools in the same category worth evaluating.

Notion

Official

Read, write, and search across Notion pages, databases, and blocks.

notiondocsdatabasesknowledge

5 minLow

Cloudflare

Official

Reach the whole Cloudflare API from an agent — DNS records, Workers, R2, and the Registrar beta — through one hosted Code Mode server.

cloudflareedgeworkersdns

5 minMedium

Obsidian

Read and write notes in your local Obsidian vault.

obsidiannotesmarkdownpkm

3 minLow

Compared with Filesystem

Side-by-side breakdowns for the choices people most often weigh against this MCP.

FilesystemvsGitHub FilesystemvsDropbox FilesystemvsBox FilesystemvsGit

Exploring Top MCPs for Filesystem & Storage? See all Filesystem & Storage MCPs →

Quick answer

What it does

Best for

Not for

Setup recipe

Install

Set required secrets

Try a minimum working prompt

Tools & permissions

Security & scope

Agent prompt pack

Full details

Frequently asked questions

Is the Filesystem MCP safe to use?

Can it write files, or is it read-only?

Does it work with Cursor and VS Code as well as Claude Desktop?

What happens if I do not pass an allowed directory?

How do I give the agent access to multiple project folders?

Can two MCP clients share a single Filesystem server?

What changed

More Filesystem & Storage MCPs

Notion

Cloudflare

Obsidian

Compared with Filesystem