FieldCure MCP Filesystem Server

A secure Model Context Protocol (MCP) server that exposes local filesystem operations to AI clients. Built with C# and the official MCP C# SDK.

Features

• 17 filesystem tools: read, write, append, delete, search, copy, move, convert-to-markdown, and more
• Sandboxed access: all operations restricted to explicitly allowed directories
• MCP roots protocol: clients can change allowed directories at runtime without restarting the server
• Security hardened: path traversal prevention, symlink resolution, NTFS ADS blocking, Windows reserved name rejection
• Atomic writes: temp-file-then-rename pattern prevents data corruption
• Binary detection: automatically returns base64 for binary files, UTF-8 for text
• Built-in document parsing: supported document formats can be read directly and converted to markdown on disk
• Stdio transport: standard MCP subprocess model via JSON-RPC over stdin/stdout

Installation

dotnet tool

dotnet tool install -g FieldCure.Mcp.Filesystem

From source

git clone https://github.com/fieldcure/fieldcure-mcp-filesystem.git
cd fieldcure-mcp-filesystem
dotnet build

Requirements

• .NET 8.0 Runtime or later

Configuration

Claude Desktop

{
  "mcpServers": {
    "filesystem": {
      "command": "fieldcure-mcp-filesystem",
      "args": [
        "C:\\Users\\me\\Documents",
        "C:\\Projects"
      ]
    }
  }
}

VS Code

{
  "servers": {
    "filesystem": {
      "command": "fieldcure-mcp-filesystem",
      "args": [
        "${workspaceFolder}"
      ]
    }
  }
}

Tools

File Operations

Directory Operations

Search & Info

MCP Roots Protocol

The server supports the MCP roots protocol for runtime directory changes. When the client changes roots:

1. The server requests the updated roots list.
2. Allowed directories are replaced entirely.
3. CLI args provide the initial sandbox.
4. An empty roots list means all file access is denied.

Security Model

All paths are validated through IPathValidator before any filesystem operation:

1. Allowed directories define the sandbox boundary.
2. . and .. are normalized via Path.GetFullPath().
3. Symlinks must resolve within allowed directories.
4. Prefix matching is directory-separator-aware.
5. NTFS alternate data streams are blocked.
6. Windows reserved names are rejected.
7. Allowed directory updates are thread-safe.

The markdown conversion tools validate both source and output paths through the same sandbox rules. They write converted markdown directly to disk instead of returning full document text through MCP, which is usually more token-efficient than read_file plus write_file.

Project Structure

src/FieldCure.Mcp.Filesystem/
|- Program.cs
|- Security/
|  |- IPathValidator.cs
|  \- PathValidator.cs
|- Tools/
|  |- FileOperationTools.cs
|  |- DirectoryTools.cs
|  \- SearchTools.cs
\- Utilities/
   |- EncodingDetector.cs
   \- FileSize.cs

Development

dotnet build
dotnet test
dotnet pack src/FieldCure.Mcp.Filesystem -c Release

Limitations

See Also

Part of the AssistStudio ecosystem.

License

MIT