File Operations MCP

Your AI can generate a perfect utility function, but if it cannot create the file and place it in the right directory, you are still copying and pasting. The gap between “AI suggests code” and “AI applies changes to your project” is bridged by filesystem access. Getting it right means balancing power with safety — the AI should modify only what you intend.

What You’ll Walk Away With

• Configuration for the official Filesystem MCP server with proper directory scoping
• An understanding of when to use Desktop Commander versus the official server
• Security patterns for restricting write access in team environments
• Prompts that leverage filesystem access for real refactoring workflows

Official Filesystem MCP Server

The reference implementation provides structured file operations: read, write, create, delete, move, and search. It enforces an allowed_directories boundary — the AI cannot touch anything outside the paths you specify.

Cursor

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "@modelcontextprotocol/server-filesystem",
        "/Users/you/projects/my-app"
      ]
    }
  }
}

Claude Code

Claude Code has native filesystem access built in. It can read, write, search, and list files without an MCP server. The built-in tools respect the project directory boundary automatically. You do not need this server unless you want to give Claude Code access to directories outside the current project.

Codex

[mcp.filesystem]
transport = "stdio"
command = "npx"
args = ["-y", "@modelcontextprotocol/server-filesystem", "/Users/you/projects/my-app"]

The server exposes these tools: read_file, write_file, create_directory, list_directory, move_file, search_files, get_file_info, and read_multiple_files. Each tool only operates within the allowed directories.

Tip

Copy-paste prompt for filesystem-powered refactoring:

“Read all TypeScript files in the src/utils directory. Identify any utility functions that are duplicated across files. Consolidate them into a single src/utils/shared.ts file, update all import statements across the project, and delete the now-empty files.”

Desktop Commander: Full Terminal Access

When you need more than file operations — terminal commands, process management, ripgrep search — Desktop Commander is the power-user alternative. It runs arbitrary shell commands, manages background processes, and provides advanced text search.

Cursor

{
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander"]
    }
  }
}

Claude Code

Claude Code already has terminal access through its native Bash tool. Desktop Commander is redundant unless you need its specific process management features.

Codex

[mcp.desktop-commander]
transport = "stdio"
command = "npx"
args = ["-y", "@wonderwhy-er/desktop-commander"]

Caution

Desktop Commander can execute arbitrary commands. It is the equivalent of giving your AI a terminal session. Use it in development only, never in shared or production environments. For team setups, stick with the official Filesystem MCP server with scoped directories.

Tip

Copy-paste prompt for Desktop Commander:

“Find all TODO comments across the entire project using ripgrep, group them by file, and create a Markdown summary with the file path, line number, and TODO text for each one. Save the result as TODO-AUDIT.md in the project root.”

Security Patterns for Teams

When multiple developers share MCP configurations, enforce these boundaries:

• Scope to project directories only. Never allow home directories, /tmp, or system paths.
• Use read-only mode for shared servers. If you only need the AI to analyze code, restrict write operations.
• Commit .cursor/mcp.json to the repo so the team shares the same scoped configuration. Keep API keys in environment variables, not in the config file.
• Prefer Claude Code for filesystem work — its built-in tools already enforce project-level scoping and require explicit approval for destructive operations.

Tip

Copy-paste prompt for safe code analysis without writes:

“Read the entire src/ directory tree. Analyze the dependency graph between modules. Identify any circular dependencies and list them. Do NOT modify any files — just report your findings as a summary.”

When This Breaks

“Permission denied” errors. The server runs as your user. If a file is owned by root or another user, the MCP server cannot read or write it. Fix file permissions or run in a container.

AI creates files in unexpected locations. This happens when the AI misinterprets a relative path. Always use absolute paths in your allowed_directories configuration.

Large file reads time out. The filesystem server reads entire files into memory. For files larger than a few megabytes, use read_multiple_files with specific line ranges or switch to a search-first approach with search_files.

What’s Next

Browser Automation MCP Let your AI interact with web pages and verify UI changes.

MCP Security Hardening MCP servers for team and production use.