PlugWiki
Agent Infra Filesystem logo

Agent Infra Filesystem MCP Server: Setup for Claude Code, Cursor and Other Apps

CommunityLocal

Lets Claude, Cursor and other assistants read, search and edit files inside folders you allow.

This server gives Claude, Cursor and other assistants tools to read, search, edit and move files in the folders you choose. It runs on your computer with npx, needs no account and refuses to start without at least one allowed folder. It has no delete tool, but it can overwrite files without asking. Keep the allowed folder under git.

Good for

  • Developers who want the assistant to edit project files directly
  • Writers who keep notes in plain files and want help organizing them
  • Cursor and Windsurf users whose app lacks a built-in file tool

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Agent Infra Filesystem MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the Agent Infra Filesystem MCP server to Claude Code. Run this command:
    
    claude mcp add agent-infra-filesystem -- npx -y @agent-infra/mcp-server-filesystem --allowed-directories /path/to/your/folder
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Read-only mode: There is no read-only option. Choose a folder that holds copies of your files if you only want it to read.

Replace /path/to/your/folder with the folder you want the assistant to use. The server exits without at least one --allowed-directories folder, and each extra folder needs its own flag. The README shows the folder flag and path as one argument; the source reads them as two (--allowed-directories, then the path), so this config splits them.

Built from the package data we hold. Not yet tested by us.

Tools

  • Reads one file

    Returns the full text of one file inside an allowed folder.

    Try: “Read src/app.ts and explain it.”

    Files · read_file

  • Reads several files at once

    Reads many files in one call. A file that cannot be read does not stop the others.

    Try: “Read package.json and tsconfig.json together.”

    Files · read_multiple_files

  • Lists a folder

    Lists the files and folders inside a directory, marked as file or folder.

    Try: “What is in the docs folder?”

    Files · list_directory

  • Shows a folder as a tree

    Returns a nested view of folders and files with their types.

    Try: “Show me the folder tree of src.”

    Files · directory_tree

  • Finds files by name

    Searches a folder and everything below it for names that contain your text, ignoring case.

    Try: “Find every file with "config" in its name.”

    Files · search_files

  • Shows size and dates for a file

    Returns details about a file or folder without reading its content.

    Try: “How big is dist/bundle.js and when did it change?”

    Files · get_file_info

  • Changes lines in a text file

    Replaces exact line sequences in a file and shows a diff of what changed.

    Try: “In README.md, change the install section title to "Setup".”

    Write · edit_file

  • Creates or overwrites a file

    Creates a file or replaces an existing one with new content, without asking first.

    Try: “Create notes/todo.md with a three-item list.”

    Write · write_file

  • Creates a folder

    Creates a folder, including missing parent folders, or does nothing if it already exists.

    Try: “Create docs/guides/setup.”

    Write · create_directory

  • Moves or renames a file or folder

    Moves or renames a file or folder inside the allowed folders. It fails if the target already exists.

    Try: “Rename draft.md to final.md.”

    Write · move_file

  • Used by the assistant behind the scenes

    Shows which folders it may use

    Lists the folders the server was started with. Every other tool only works inside them.

    Try: “Which folders can you access?”

    Files · list_allowed_directories

Read from the source code

Permissions

medium risk · 3 things to watch

Medium risk

The assistant can read, create, edit, move and overwrite files inside the folders you list when you start it, and write_file replaces existing files without warning. Allow only the folders you need and keep a backup or git history of them.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It overwrites files without asking

    write_file replaces an existing file. Keep the allowed folder under git or backed up. github.com

  • It will not start without a folder

    The source exits with a usage message if no allowed folder is given, so there is no accidental whole-disk access. github.com

  • It has no delete tool

    The tool list has no way to delete a file, but write_file can empty one and move_file can move it out of sight. github.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Turning on read-onlyNo read-only switch is documented. Limit the damage by listing only the folders you want it to reach.
Sign-in and keysNo account or key. Access is limited to the folders you pass with --allowed-directories.

Questions

Which folders can it access?

Only the folders you pass when you start it. It exits with a usage message if you give none, so choose the folder in the install box before you save the config.

Can it delete files?

There is no delete tool. It can overwrite a file with new content, move it and rename it.

Is there a read-only mode?

No read-only switch is documented. Allow a folder that holds copies if you only want it to read.

Does it need an API key?

No. It runs on your computer with no account.

Can it run as a local web server?

Yes. Add the --port option and it serves a Streamable HTTP address and an older SSE address on your machine, for apps that connect by URL. Keep it on 127.0.0.1 unless you trust your network.

Information

updated Nov 2, 2026

Publisher
Community
Package
@agent-infra/mcp-server-filesystem
Registry
npm
Transport
stdio, SSE, Streamable HTTP
Auth
None
Version
1.0.0
License
MIT
Last commit
Oct 9, 2026
Open issues
358
Listed in
Official MCP registry

GitHubnpmOfficial MCP Registry

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 3
  1. Filesystem server README · github.com
  2. Command-line options · github.com
  3. Tool registrations · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.