Model Context Protocol Filesystem MCP Server

The MCP reference server's Filesystem MCP server provides AI agents with controlled access to local and mounted directory structures. It empowers agents to read file contents, create and update documents, recursively list directories, search for file patterns, and manage project file hierarchies within configurable path boundaries.

Start for free

Benefits with Ory + Model Context Protocol Filesystem MCP Server

The Filesystem MCP reference server from the Model Context Protocol project lets your agents read, write, and move files inside the directories you allow. Within those directories, the server has no notion of which agent should touch which file. Ory Agent Security adds that layer, so a code reviewer can read and search a repository while only the editing agents you approve can change files, and every file operation is attributed to the user and agent behind it.

View on GitHub

Use Cases

— 01 use case

Agent IAM

Reviewers read and search at Read, editing agents get Write, the occasional reorganizer gets Admin to move files, and Block keeps everyone else off the disk.

Explore Agent IAM

Core Functionality

— 04 capabilities

Read, write, admin, or no access
Ory Agent Security classifies every tool on the Filesystem MCP reference server as read, write, or admin, so you can give each user, team, or agent type only the level it needs: read for review and search agents, write for the editing agent assigned to a task, admin for the occasional agent that reorganizes a project, and no access for agents with no business on disk.
Enforced before execution
Ory Agent Security checks each tool call against the user, the agent acting for them, and any sub-agent inside the agent harness, so a denied file overwrite stops before it reaches your files, with nothing to roll back and no gateway to deploy.
Observe, then enforce
Observe mode shows which agents write files and for whom, while the writes still go through without blocking anything, so you can apply Ory's pre-built policy for the Filesystem MCP reference server and enforce it on your own schedule.
Complete audit trail
Every allow and deny decision on the Filesystem MCP reference server streams to your SIEM through OpenTelemetry with the user, agent, and action attached, so you can show which agent changed a file and on whose behalf.