Mcp Filesystem
Give agents a jailed, read-only-by-default filesystem MCP root so they can read project files without path traversal or symlink escapes.
Overview
mcp-filesystem is a Build-phase MCP server that provides a jailed, read-only-default filesystem for AI agents with traversal and symlink safety.
What is this MCP server?
- Jailed filesystem root limits agent access to one directory tree
- Read-only default reduces accidental writes during exploration
- Traversal and symlink protections against escape attempts
- Stdio MCP @infoinlet/mcp-filesystem v0.1.1
- Hardened alternative to permissive built-in file tools
- Server version 0.1.1
- npm package @infoinlet/mcp-filesystem
- stdio transport
What problem does it solve?
Wide-open file tools let agents read or write outside the project and create symlink or path traversal risks on your machine.
Who is it for?
Solo developers who want a explicit MCP filesystem boundary around one codebase while tuning agent permissions.
Skip if: Multi-user permission models, remote object storage, or workflows that require unrestricted system-wide file access.
What do I get? / Deliverables
Agents work inside a bounded repo jail with safer defaults so you can delegate file reads during build tasks with less exposure.
- Bounded read access to project files from the agent
- Reduced traversal and symlink risk versus naive file MCPs
- Configurable root suitable for monorepo or single-app workflows
Recommended MCP Servers
Journey fit
How it compares
Jailed filesystem MCP, not cloud storage sync or a full IDE replacement.
Common Questions / FAQ
Who is mcp-filesystem for?
Builders shipping with AI coding agents who need a constrained, hardened local file surface instead of unrestricted disk access.
When should I use mcp-filesystem?
Use it during build and agent-tooling setup when you configure MCP servers and want read-only-by-default repo access.
How do I add mcp-filesystem to my agent?
Install @infoinlet/mcp-filesystem, set the jail root path in MCP stdio config, keep read-only unless a task needs writes, then reload the client.