Best for
- MCP clients that need controlled local file access
- Developers who want to explicitly constrain filesystem operations
U
UI-TARS Filesystem MCP Server
Official
Restricted filesystem access for MCP
- Category
- Filesystem #20 of 24
- Stars
- ★ 39.3k Very popular
- Transport
- stdio (local process) · SSE · Streamable HTTP
- Runtime
- Node.js
- Credentials
- No credential needed
- License
- Apache-2.0
- Last commit
46FMRS · D
The source identifies this as an active filesystem MCP server supporting three transports and requiring an explicitly configured directory allowlist. It does not document individual tools, client compatibility, or authentication.
Strongest · Maintenance 13/20 Weakest · Documentation 7/20
Why each score
- Reliability 8/20
- The manifest identifies an npm package, three transports, and required arguments, so a plausible startup path exists. However, the supplied material contains no server-specific tool list, source, tests, CI, or error-handling evidence, so MCP initialization, tool-list handshake, and behavioral consistency cannot be verified; the score is conservative.
- Security and permissions 8/20
- The required allowed-directories argument indicates directory scoping, and the SSE and Streamable HTTP endpoints bind to 127.0.0.1, providing some boundary control. The material does not document authentication, traversal protection, confirmation for dangerous file operations, network data flows, credential handling, or fine-grained permissions, so points are deducted.
- Maintenance 13/20
- The repository is not archived, uses Apache-2.0, shows activity signals, and the README lists releases through 2025-11. However, there is no server-specific evidence of maintainers, releases, commits, dependency updates, or a security-response channel, so this does not merit a high score.
- Documentation 7/20
- The manifest documents the package identifier, transports, directory argument, and default port. The README primarily covers the broader repository and other Agent/MCP capabilities; it lacks server-specific tools and parameters, limits, authentication, cost, troubleshooting, and a complete client configuration example, so points are deducted.
- Setup experience 10/20
- The npm package and three transport declarations make the general installation direction clear, and allowed-directories plus a default port are specified. However, there are no complete steps from runtime preparation to connection in a mainstream MCP client, nor evidence of platform compatibility, exact launch commands, or secure SSE/HTTP configuration, so the score remains moderate.
Static review · not runListed 2026-07-29
Read the FMRS scoring method →Fit and risk
What it can accessReads local filesWrites / deletes local files
Not for
- Workflows that require access to unauthorized directories
- Users seeking a server with documented tool names or broader capabilities
Required permissions
- The server needs file-operation access to the directories listed in allowed-directories
- SSE and Streamable HTTP modes require use of the configured local port
Risks and side effects
- An overly broad allowed-directories value may expand the scope of local files that can be exposed or modified
- When using a local SSE or HTTP endpoint, port and access-scope configuration should be reviewed
- The source does not specify individual filesystem tools, authentication, or authorization mechanisms
Setup
Before you start
Runtime：Node.js
Use @agent-infra/mcp-server-filesystem from the npm registry and provide the required allowed-directories argument to define the directories permitted for file operations. SSE and Streamable HTTP modes also require a port number, defaulting to 8089.
Check that it works
After connecting the server in your client, check that filesystem tools appear in the tool list; then ask it to list files in an allowed directory and confirm real directory contents come back.
Troubleshooting
- Check that the required allowed-directories argument is supplied
- For SSE or Streamable HTTP, check the port configuration; the default is 8089
- Confirm that the client's transport matches the server configuration
- Verify that the configured directories exist and are accessible to the server
Things to try
Once connected, you can ask your AI assistant things like:
- List all files in one of the allowed directories
- Read the contents of /path/to/project/README.md and summarize it
- Create a notes.txt file in the working directory and write a few lines to it
Use cases
Giving an MCP client access to files in selected directories
Providing directory-scoped local file operations to agent workflows
Overview
This is the filesystem MCP server contained in the UI-TARS-desktop repository. It provides file operations within directories configured through allowed-directories. The manifest lists it as active, version 1.0.0, with stdio, SSE, and Streamable HTTP transports.
Similar servers
Filesystem MCP Server
84 · B
Secure local file read/write access
Vault Cortex MCP Server
79 · B
Standalone MCP server for Obsidian vaults: hybrid search, notes & files, structured memory, tasks, OAuth 2.1.
Obsidian Web MCP
68 · C
Secure remote access to your Obsidian vault over HTTPS with OAuth 2.0 authentication.
Safe Docx MCP Server
68 · C
AI-native surgical editing of Word and OpenDocument files with formatting preservation
More servers from this repository
Source revision 3ac2cb8d946d Data synced 2026-10-19 Read the FMRS scoring method