Setting up Filesystem MCP securely

Filesystem MCP gives an AI client direct access to local files. The important question is therefore not only whether the server starts, but which directories and write permissions it receives.

Requirements for Filesystem MCP

You need an MCP client and Node.js with npx. The official Docker image is an alternative. Choose the smallest practical project folder in advance; do not expose your home directory, SSH keys, password stores, or global configuration folders.

Setting up Filesystem MCP with npx

npx -y @modelcontextprotocol/server-filesystem /absolute/path/to/project

Add the command and path to your client's MCP configuration. Every additional path increases the attack and error surface. If the client supports MCP Roots, it can supply allowed directories dynamically; these roots replace startup arguments.

Limiting Filesystem MCP write access

The server includes tools that can overwrite, edit, and move files. For analysis-only work, a read-only Docker mount marked ro is the safest option. When write access is enabled, keep files under version control or backed up and review changes before committing them.

Verifying the setup

After startup, use list_allowed_directories to verify the effective directory allowlist. Also use a harmless test file to confirm that reading and, if intended, writing work as expected.

Common setup mistakes

A frequently overlooked problem is using a relative instead of an absolute path at startup — some clients resolve relative paths against a different working directory than expected, causing the server to expose the wrong directory or fail to start at all. Another pitfall is accidentally exposing a parent folder instead of the actual project folder, for example when the entire home directory is specified for convenience instead of a subfolder. It's therefore always worth double-checking the actual path passed before going into production use.

Combining with other MCP servers

Filesystem MCP combines well with research tools like Fetch MCP: one server retrieves information from the web, the other stores it in a structured way in the project folder or reconciles it with existing files. This combination calls for extra caution when unreviewed web content flows into write operations — an agent should never blindly translate instructions from a fetched web page into file changes.

For teams with multiple projects

Anyone wanting to use Filesystem MCP for several projects at once should set up a separate server instance with its own exposed path for each project, rather than sharing a common parent directory. This prevents an agent from accidentally modifying files in the wrong project when multiple tasks run in parallel.

Backing up before the first write access

Before write tools are used in production for the first time, a full backup of the exposed folder is worth doing, for example via a git commit or a simple copy. That way, any unexpected change can be undone without depending on working version control inside the project itself.

Source: official modelcontextprotocol/servers repository, checked on 2026-09-03.