Secure filesystem MCP server for reading, writing, searching, diffing, and patching files.
Filesystem MCP server exists for a simple reason — assistants are far more useful when they can act on Filesystem directly instead of describing what you should do. Secure filesystem MCP server for reading, writing, searching, diffing, and patching files.
A secure, production-ready Model Context Protocol server that gives AI assistants controlled access to the local filesystem. All operations are sandboxed to explicitly allowed directories with path traversal prevention, sensitive file blocking, and optional Bearer token authentication.
Installation goes through your MCP client rather than a global install: point it at @j0hanz/filesystem-mcp on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Once Filesystem is connected, these are the calls the assistant has available:
Tools — The Tools tool exposed by this serverroots — List allowed workspace roots. Call first — all other tools are scoped to these directoriesfind — Find files by glob pattern. Returns matching files with metadatatree — Render a directory tree with bounded recursion. Returns ASCII tree + structured JSONread — Read text file contents. Use head/tail to preview first/last N lines of large filesread_many — The read_many tool exposed by this serverstat — Get file/directory metadata: size, modified, permissions, mime, tokenEstimatestat_many — The stat_many tool exposed by this servergrep — Search file contents (grep-like). Returns matching lines with optional contextmkdir — The mkdir tool exposed by this serverAmong the file and storage access options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Filesystem's toolset — Tools, roots, find and 7 more — is a fair guide to whether it matches your workflow. It is maintained by GitHub Actions; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Tools | The Tools tool exposed by this server. |
| roots | List allowed workspace roots. Call first — all other tools are scoped to these directories. |
| find | Find files by glob pattern. Returns matching files with metadata. |
| tree | Render a directory tree with bounded recursion. Returns ASCII tree + structured JSON. |
| read | Read text file contents. Use head/tail to preview first/last N lines of large files. |
| read_many | The read_many tool exposed by this server. |
| stat | Get file/directory metadata: size, modified, permissions, mime, tokenEstimate. |
| stat_many | The stat_many tool exposed by this server. |
| grep | Search file contents (grep-like). Returns matching lines with optional context. |
| mkdir | The mkdir tool exposed by this server. |
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@j0hanz/filesystem-mcp@latest"]
}
}
}Configuration as documented by the project. Restart the client after saving.
Scoped local file access — read, write, search and reorganise files in directories you explicitly allow.
Search and read your Drive — Docs, Sheets and files become context your assistant can actually use.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Chat with your second brain — search, read and write vault notes through the Local REST API.
Connects AI models to an Obsidian knowledge base for direct access and manipulation of notes and folders.