The filesystem MCP server gives agents file access. How does it stop them from reading everything on disk?

Attempt it

It restricts access through a directory allowlist passed on the command line at launch (e.g., npx @modelcontextprotocol/server-filesystem /Users/me/Projects). Every file operation's path is resolved and checked against those allowed roots; anything outside is rejected. This check lives in the server's own code. The MCP protocol provides no isolation, and the server runs as the user's OS account, so the allowlist is the entire sandbox.

Your answer

The **filesystem MCP server** (`@modelcontextprotocol/server-filesystem`) stops agents from reading everything on disk through a directory allowlist you set at launch time. When you start the server, you pass one or more directories as command-line arguments: ``` npx @modelcontextprotocol/server-filesystem /Users/me/Projects /Users/me/Documents ``` Every tool call the model makes (read_file, write_file, edit_file, list_directory, search_files) goes through a path check inside the server. The server resolves the requested path (handling `..`, symlinks, and casing) and verifies it falls inside one of the allowed roots. If not, the operation is rejected with an error. The critical point is where the boundary lives. The MCP protocol itself carries no filesystem semantics and provides no isolation. The host (Claude Desktop, Cursor) launches the server but does not constrain its IO. The only thing standing between the agent and the rest of your disk is the server's own JavaScript path check plus the directories you chose. The server runs as your OS user with your file permissions. This means two things in practice: pick narrow roots, and never pass `/` or `~/` as an allowed directory unless you genuinely trust the agent with everything you own.

The **filesystem MCP server** uses a directory allowlist as its sole sandboxing mechanism. The allowlist is declared on the command line at launch: `npx @modelcontextprotocol/server-filesystem /Users/me/Projects`. Every incoming tool call's path argument is resolved (following symlinks, normalizing `..` and casing) and checked against the allowed roots before any IO happens. Operations outside the roots are rejected. The server exposes tools like `read_file`, `write_file`, `edit_file` (cheaper than full rewrites for partial edits), `list_directory`, `search_files` (recursive filename matching), `move_file`, `create_directory`, and `get_file_info`. All of them are subject to the same path check. The protocol provides no sandboxing. MCP is a JSON-RPC protocol for tool calls and responses; it carries no filesystem semantics and no isolation primitives. The host launches the server as a subprocess but does not constrain its IO. The server inherits the OS user's file permissions. Pass `/` as the root and the server can read and write anything you can. For personal use (Claude Desktop on a laptop), narrow roots and your OS user model are sufficient. For shared or production deployments, the standard hardening pattern is to run the server in a container with bind-mounted directories so the kernel enforces the boundary even if the server has a bug, and to require human confirmation for write tool calls.

Quick reference

TL;DR

The filesystem server restricts access via a directory allowlist on the command line; every path is resolved and checked against those roots, and the MCP protocol itself provides no isolation.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine giving a helper access to a few specific drawers in a filing cabinet, but nothing else. When you start the filesystem MCP server, you hand it a list of folders it is allowed to touch. The server can read files, write files, list folders, and search, but only inside those approved folders. If the helper asks for something from a drawer you did not approve, the server says no. The important part is that only the server enforces this rule. The MCP protocol itself does not know anything about files or folders. And the server runs as you, using your permissions. If you accidentally said 'every drawer in the building is fine,' the helper could go anywhere you could go. So you keep the list narrow.

Key concepts

Filesystem MCP server Sandboxing Directory allowlist

Detailed answer & concept explanation

~5 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.

Sign in for 5 free unlocks/day or go Pro for unlimited. See Pro pricing.

Quick scan · 2–4 min

Everything important, quickly.

3 min: describe the directory allowlist mechanism, walk the path resolution and check, list the headline tools, explain why the protocol itself provides no isolation, name the OS user as the real trust boundary, and close with the container hardening pattern.

Real-world examples

Real products, models, and research that use this idea.

Claude Desktop users scope a filesystem server entry to `~/Documents/notes` so the agent can read and edit notes without touching anything else on disk.
Cursor users add a filesystem server scoped to a single project directory in `.cursor/mcp.json`, giving the agent file access beyond the editor's built-in tools.
Hardened deployments run the server in a Docker container with `--read-only` rootfs and a single bind-mounted writable directory, so even a server bug cannot escape the bound volume.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow does the filesystem server prevent symlink escapes?

Sign in or go Pro to see the approach for this follow-up.

QWhy is the directory allowlist on the command line instead of in the MCP initialize message?

Sign in or go Pro to see the approach for this follow-up.

QHow would you harden a production filesystem server beyond the default?

Sign in or go Pro to see the approach for this follow-up.

Don't say this

Red flags and common mistakes that signal junior thinking. Click to expand.

Most common mistake

Assuming the MCP protocol provides built-in sandboxing. It does not. The filesystem server's own path check plus the directories you allow on launch are the entire boundary.

Sign in or go Pro to see all red flags and common mistakes. See Pro pricing.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.