list_allowed_directories is the call to make first, because every file operation is confined to what it returns. Editing is line-based and hands back a git-style diff, with a dry run available, which makes a change reviewable before it is written. The execution side is wider than the file side — a checked command runner, direct bash with environment and timeout, piped sequences, and curl with method, headers and data — and the vendor describes those as carrying security restrictions rather than the same directory confinement.
A filesystem server scoped to allowed directories, with command execution and an HTTP request tool alongside it.
- Files read one at a time or several at once with an encoding, written whole, and edited by exact line sequences returning a git-style diff, with a dry run available.
- Directories created including nested paths, listed with file and directory markers, and returned as a recursive JSON tree.
- Files and directories moved or renamed in one operation, failing rather than overwriting when the destination already exists.
- Recursive case-insensitive search by partial name with exclude patterns, and file metadata covering size, creation and modification times, permissions and type.
- The list of directories the server may touch, and performance metrics for its own operations.
- Command execution: a checked command runner, direct bash with environment variables and a timeout, piped bash sequences returning both stdout and stderr, and curl requests with method, headers and body.
Directories explicitly allowed on the server, since every file operation is confined to them, plus bash and curl on the host for the execution tools.
One command — npx -y @gabrielmaialva33/mcp-filesystem