Enable Filesystem Access for MCP Servers, Step by Step

Oct, 2026
4 min read

Summarize:

Read

AI and LLMs have proven to useful in many ways. However, this usually means using a website that was trained on unknown, publicly available data.

What if you want to use local files and make changes locally?

That’s where the filesystem functionality in Model Context Protocol (MCP), a standardized protocol for linking AI agents to backend systems and data sources, comes in.

This is a quick guide on how to enable Claude Desktop on macOS to access your local filesystem using the MCP.

Key Takeaways

Giving an AI agent access to local files takes a few minutes, since Claude Desktop launches the filesystem MCP server from a short entry in claude_desktop_config.json.
The part that matters is the scope, so share only the folders the agent needs and keep credentials out of reach, because the server can act on anything inside them.
Four tools can change files (write_file, edit_file, move_file and create_directory), and the first three are marked destructive because they overwrite, rewrite or relocate existing files.
The server has no read-only mode of its own, so running it in Docker with folders mounted read-only is the documented way to limit an agent to reading files.

Prerequisites

1) Install Claude Desktop

Download and install the latest version of Claude Desktop for macOS from Anthropic’s official website.

2) Install Node.js

Ensure Node.js is installed on your system. Open Terminal and run:

node –version

If Node.js is not installed, the easiest way to do it is to download the installer from https://nodejs.org/. Node.js allows the ‘npx’ command below.

Configure the Filesystem MCP Server

Open Claude Settings

1) Launch the Claude Desktop app.

2) Click on the Claude menu in the top-left corner and select ‘Settings.’

3) Navigate to the ‘Developer’ tab.

4) Click ‘Edit Config’ to open the configuration file.

(Note: If the “claude_desktop_config.json” file doesn’t exist. Create one under `/Users/your_username/Library/Application Support/Claude/`)

Edit the Configuration File

1) In the opened `claude_desktop_config.json` file, replace its contents with the following, adjusting the paths to the directories you want Claude to access:

				
					{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-filesystem",
"/Users/your_username/Folder1",
"/Users/your_username/Folder2"
]
        }
   	}
}

2) Replace `/Users/your_username/Folder1` and with the absolute paths to the directories you wish to grant access to.

3) Ensure the paths are correct and that you have the necessary permissions for these directories.

Save and Close

1) Save the changes to the configuration file and close the text editor.

Restart Claude Desktop

1) Completely close the Claude Desktop application. Reopen Claude Desktop to apply the new configuration. If there are issues with the configuration, you will see messages upon start up.

How to Limit What the Filesystem MCP Server Can Access

The folder paths in your config define everything the server can reach. The filesystem MCP server refuses any operation outside its allowed directories, so the folders you list in claude_desktop_config.json decide what an AI agent can read and change on your machine.

Some clients that connect with a 2025-era protocol version can replace that list at runtime through MCP Roots. Roots is deprecated as of MCP protocol version 2026-07-28, so the folder paths in your config are the method that works on every client. To see the directories the server is using at any point, ask the agent to run the list_allowed_directories tool.

Share Only the Folders the Agent Needs

Point the server at the specific project folders a task requires. Never share your home folder (/Users/your_username) or any folder that holds credentials or secrets, such as ~/.ssh, ~/.aws or a project directory with .env files. Sharing a folder also shares every subfolder inside it, so one broad path can expose far more than you intended.

Know Which Tools Can Change Files

Most of the server’s tools only read. Four of them can change what’s on disk.

write_file creates a new file or overwrites an existing one. The README advises caution with this tool.
edit_file applies pattern-based edits to a file. The README recommends running it with dryRun set to true first, which previews the diff without changing the file.
move_file moves or renames files and directories, which removes them from their original location.
create_directory creates new directories, including any missing parent directories.

The server marks write_file, edit_file and move_file as destructive in its MCP tool annotations, which gives clients a signal to flag those calls before they run.

Use Docker for Read-Only Access

The filesystem server has no server-wide read-only setting. For read-only access, run the server in Docker and mount each folder with the ro flag, which the README notes makes that folder read-only to the server. Docker mounts go under /projects by default, as in this example.

One prerequisite: The Docker config only works if Docker Desktop is installed and running.

{
  "mcpServers": {
    "filesystem": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--mount", "type=bind,src=/Users/your_username/Folder1,dst=/projects/Folder1,ro",
        "mcp/filesystem",
        "/projects"
      ]
    }
  }
}

Every folder you share becomes part of what an AI agent can reach, and an agent on a laptop can use any local files and credentials it’s given. Folder scope is one layer of MCP security, and the same least-privilege approach applies to every server an agent connects to. If your team is weighing deploying desktop AI agents on company laptops, settle what each agent can access before you roll it out.

Verify the Setup

Upon restarting, look for a hammer icon in the bottom-right corner of the Claude interface.

Clicking this icon should display tools like `read_file`, `write_file`, and `list_directory,’ indicating that the Filesystem MCP Server is active.

By following these steps, you should be able to enable Claude Desktop to interact with your local filesystem using MCP, allowing for tasks such as reading, writing, and organizing files through natural language commands.