universal-mcp-fs
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@universal-mcp-fslist files in my projects directory"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
universal-mcp-fs
A secure, local MCP server that gives AI assistants controlled access to your filesystem.
π οΈ Built With
Overview
universal-mcp-fs gives AI assistants β Claude Desktop today, and any other stdio-compatible MCP client as they add support β filesystem access and command execution on your machine, gated behind an interactive approval system.
stdio only. No HTTP server, no open ports, no internet exposure.
Elicitation-based approval. Dangerous actions (delete, run commands, move files) pause and ask the connected client to show a native approval popup β the same kind of Allow/Deny prompt you already see for other tool calls in Claude Desktop.
Sensitive paths are blocked outright (
.ssh,.aws,.gnupg, browser credential stores,/etc/shadow, etc.) β before any approval prompt is even offered.17 tools covering file read/write/move/copy/delete, directory listing, filename and content search, and shell command execution (foreground and background).
Related MCP server: Remote Server MCP
Install
Option 1 β npm (recommended, no build step)
npm install -g universal-mcp-fsOption 2 β from source (GitHub)
git clone https://github.com/Prabhas125/universal-mcp-fs.git
cd universal-mcp-fs
npm install
npm run buildSetup: Claude Desktop
Edit your Claude Desktop config file:
Windows:
%APPDATA%\Claude\claude_desktop_config.jsonLinux:
~/.config/Claude/claude_desktop_config.jsonmacOS:
~/Library/Application Support/Claude/claude_desktop_config.json
If you installed via npm (Option 1):
{
"mcpServers": {
"filesystem": {
"command": "universal-mcp-fs",
"args": ["--allowed-dirs", "/home/user;/home/user/projects"]
}
}
}If you built from source (Option 2):
{
"mcpServers": {
"filesystem": {
"command": "node",
"args": [
"/full/path/to/universal-mcp-fs/dist/index.js",
"--allowed-dirs",
"/home/user;/home/user/projects"
]
}
}
}On Windows, use double-escaped backslashes in the path, e.g. "C:\\Users\\yourname\\projects\\universal-mcp-fs\\dist\\index.js".
Then restart Claude Desktop. It will spawn the server automatically and the 17 tools will be available in chat. No further setup, no login, no token.
Verify it's connected
Ask Claude something like "list the files in [one of your allowed directories]". If it responds with a directory listing, the server is connected. If Claude says it has no matching tool, double check the config file path and JSON syntax, then fully quit and reopen Claude Desktop (a reload isn't enough β it only reads this file on startup).
Configuration options
All options can be passed as CLI args in the config's args array, or as environment variables in an env block.
CLI flag | Env var | Default | Description |
|
| your home directory | Semicolon-separated list of directories the server may access |
|
| commands enabled | Disables |
|
| delete enabled | Disables |
|
| 10485760 (10 MB) | Max bytes |
|
| 30000 | Default timeout for |
|
| 120000 | How long an approval popup waits before auto-denying, in ms |
|
| 50 | Cap on results from search tools |
Tool reference
Filesystem β read_file, read_file_lines, write_file, create_directory, list_directory, move_file, copy_file, delete_file, delete_directory
Search β search_files (by filename/glob), search_content (grep-like, with context lines)
Commands β run_command, run_command_background, list_processes, kill_process
Info β file_info, system_info
Full parameter docs are visible to the AI client automatically (and to you, via npx @modelcontextprotocol/inspector).
Permission system
Some tools always require your approval before running: delete_file, delete_directory, run_command, run_command_background, move_file, kill_process, and write_file when overwriting an existing file.
When one of these is called, the server sends an elicitation request to Claude Desktop, which renders it as a native approval dialog β the same UI you already see for regular tool-call confirmations. You can:
Approve β the action runs once
Approve + "always allow" β this exact action (same tool, same file/command) is silently approved from then on, persisted to
~/.universal-mcp-fs/always-allow.jsonDecline/cancel β the action is aborted, nothing happens
If you don't respond within 2 minutes, the request automatically resolves to denied β it will not hang the connection or leave Claude waiting indefinitely.
Sensitive paths (.ssh, .aws, .gnupg, browser credential files, /etc/shadow) are rejected before any approval prompt is offered β no amount of clicking "allow" gets past this list. You can extend it via config/default.json if you build from source.
Every decision (approved, declined, always-allow, timed out, blocked) is logged to ~/.universal-mcp-fs/audit.log and to stderr, visible in Claude Desktop's MCP server logs.
Security model
No network transport β this server never opens a port or listens for external connections.
All file operations are validated against
--allowed-dirs; anything outside is rejected regardless of approval.Symlinks are resolved before validation, so a symlink inside an allowed directory can't be used to escape it.
Path traversal (
../..) is normalized away before any check runs.If the connected client doesn't support elicitation, dangerous tools fail closed (denied), never fail open.
Publishing / contributing
npm run build
npm version patch # bumps package.json, creates a git tag
git push && git push --tags
npm publishIssues and PRs welcome.
License
MIT
Available Tools
17 toolscopy_fileCopy File or DirectoryA
Copy a file or directory (recursively for directories). Does not modify the source, so no approval is required.
Args:
source (string): Path to copy from.
destination (string): Path to copy to.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | Path to copy from | |
| destination | Yes | Path to copy to |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are neutral (readOnlyHint=false, destructiveHint=false). The description adds that source is not modified and that directories are copied recursively, providing useful behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief (two sentences plus an Args list) and front-loads the key behavioral traits (no source modification, recursive). Every sentence provides essential information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple copy tool, the description covers the main behavior (copy file/directory, recursive, non-destructive to source). However, it does not explain overwrite behavior (e.g., what happens if destination exists) or permission requirements, which could be important for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters. The description simply repeats the parameter names and brief descriptions from the schema without adding additional constraints, formats, or default behaviors.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Copy' and the resources 'file or directory', and distinguishes it from move by noting it does not modify the source. It also specifies recursive behavior for directories, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (when a copy is needed without altering source) and hints at no approval required. However, it does not explicitly compare to sibling tools like move_file or write_file, nor does it mention scenarios where this tool should not be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_directoryCreate DirectoryAIdempotent
Create a directory, including any missing parent directories (like mkdir -p).
Args:
path (string): Directory path to create.
Returns: confirmation of the created path. No error if the directory already exists.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory path to create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful context beyond annotations: it explains the mkdir -p behavior, confirms idempotency, and describes the return value. Annotations only provide idempotentHint true; description fills in practical details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences plus a brief parameter listing. Every sentence adds value, and the key behavior (mkdir -p) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers the core behavior (create with parents), error handling (no error if exists), and return value, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the parameter description in the schema already states 'Directory path to create'. The description repeats this without adding extra meaning, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'create' and resource 'directory', and distinguishes this tool from siblings like delete_directory and list_directory by specifying the mkdir -p behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (to create directories with parent directories) and notes idempotent behavior (no error if exists), but does not explicitly mention when not to use or alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_directoryDelete DirectoryADestructive
Permanently delete a directory and all its contents, recursively. ALWAYS requires interactive user approval before proceeding β this cannot be undone.
Args:
path (string): Directory to delete.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true; description adds useful context: permanent, recursive, requires user approval. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with purpose, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Single parameter, no output schema needed; description covers key behavioral aspects for a destructive operation. Minor gap: no mention of error handling or permissions, but acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and description restates the same 'Directory to delete' without adding additional semantics or format constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Permanently delete' and resource 'a directory and all its contents, recursively', clearly distinguishing from siblings like delete_file and create_directory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states that interactive user approval is always required and that the operation is irreversible, providing clear guidance on when to use with caution. Does not mention alternative tools but context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_fileDelete FileADestructive
Permanently delete a single file. ALWAYS requires interactive user approval before proceeding β this cannot be undone.
Args:
path (string): Path to the file to delete.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the file to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations (destructiveHint=true) by emphasizing permanence and the requirement for interactive approval. This provides essential behavioral context that annotations alone do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely conciseβtwo sentences, with a bold warning that immediately draws attention. Every sentence is necessary and adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers purpose, behavior, and usage guidelines completely. No additional information is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the 'path' parameter. The description restates it without adding additional meaning or constraints beyond what the schema provides, so it meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Permanently delete a single file.' It specifies both the verb (delete) and the resource (file), and it distinguishes from siblings like delete_directory and move_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a critical usage guideline: 'ALWAYS requires interactive user approval before proceeding β this cannot be undone.' It implicitly advises caution and indicates that this tool is for permanent deletion only, but does not explicitly mention alternatives like moving to trash.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_infoGet File InfoARead-onlyIdempotent
Get metadata about a file or directory: size, created/modified dates, permissions, and type.
Args:
path (string): Path to inspect.
Returns: size in bytes, created/modified timestamps, POSIX permission bits, and whether it's a directory or symlink.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to inspect |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds value by specifying the return fields (size, timestamps, permissions, type), which goes beyond the annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise: a one-line summary followed by clear Args section. No extraneous content, front-loaded with key purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema and absence of output schema, the description adequately covers what the tool does and what it returns. No missing critical information for a metadata retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and description repeats the schema for path with minimal addition ('Path to inspect'). Description does not significantly enhance parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets metadata about a file or directory, listing specific attributes. This distinguishes it from siblings like read_file (content) and list_directory (entries).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool vs alternatives. Usage is implied by the metadata purpose, but no exclusions or context are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kill_processKill Background ProcessADestructive
Terminate a background process previously started with run_command_background. Requires interactive user approval before proceeding.
Args:
pid (number): Process ID to kill (must be one tracked by this server β see list_processes).
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID to terminate |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations indicating destructiveness, the description adds that the process must be tracked and requires user approval. This provides behavioral context, though it could clarify what happens if the PID is invalid or not tracked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence plus an Args list, both concise and front-loaded. No unnecessary text; every part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single parameter, clear annotations, and no output schema, the description is mostly complete. It could benefit from mentioning the tool's return value or confirmation behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the description adds value by specifying the PID must be one tracked by this server and references list_processes. This provides useful context beyond the schema's basic description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Terminate', the resource 'background process', and specifies it must be one started with run_command_background. It distinguishes from sibling tools by connecting to the background process management context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this tool to terminate processes started by run_command_background, and it requires interactive approval. However, it does not explicitly mention when not to use it or alternatives for other process types.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_directoryList DirectoryARead-onlyIdempotent
List the contents of a directory with metadata (type, size, modified date).
Args:
path (string): Directory to list.
recursive (boolean, optional): List subdirectories recursively. Default: false.
show_hidden (boolean, optional): Include dotfiles/dotdirs. Default: false.
Returns: a listing with one entry per line: type, size, modified date, name.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory to list | |
| recursive | No | List subdirectories recursively | |
| show_hidden | No | Include dotfiles/dotdirs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true. The description adds value by specifying the return format (type, size, modified date, name), which is beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a clear structure: purpose followed by Args and Returns sections. Every sentence adds value, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return format. All 3 parameters are fully covered. The tool is simple and the description is complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description repeats schema info and adds a summary of return format, but does not add deeper semantic meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and resource 'directory contents with metadata'. It distinguishes from sibling tools like read_file (file content) and system_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing directories, but provides no explicit guidance on when to use this tool vs alternatives, nor exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_processesList Background ProcessesARead-onlyIdempotent
List background processes started via run_command_background during this session, with their status.
Returns: a list of tracked processes with PID, command, status, and start time.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description adds value by specifying the session boundary and output fields. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with purpose and return details. No unnecessary words, earning its place efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and clear annotations, the description provides sufficient context: session scope, source, return fields. Complete for this low-complexity tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist (schema coverage 100% via absence). The description correctly omits parameter details, and the baseline for zero parameters is 4, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists background processes started via run_command_background during the current session, with status and specific return fields (PID, command, status, start time). This distinguishes it from siblings like run_command, run_command_background, and kill_process.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description explicitly defines the scope (background processes from run_command_background, session-limited) making it clear when to use. However, it does not explicitly mention when not to use or provide direct comparisons to alternatives, though the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_fileMove or Rename FileADestructive
Move or rename a file or directory. ALWAYS requires interactive user approval before proceeding.
Args:
source (string): Current path.
destination (string): Target path.
Error Handling:
Both source and destination are validated against allowed directories and blocked paths.
Returns an error if the user declines the approval prompt.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | Current path of the file or directory | |
| destination | Yes | Target path to move/rename to |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds critical behavioral context beyond annotations: it discloses the requirement for user approval and validation against allowed/blocked paths. Annotations only indicate destructiveness, so the description enriches transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (four short lines), front-loads the main purpose, and includes essential usage and error handling details. Every sentence serves a clear purpose with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with no output schema, the description covers purpose, approval requirement, and error handling. It does not describe the return value, but the context is largely complete given the low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters already described in the schema. The description repeats the parameter names and types without adding new meaning, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Move or rename a file or directory,' specifying the verb (move/rename) and resource (file/directory). This distinguishes it from sibling tools like copy_file, delete_file, and write_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes that the tool 'ALWAYS requires interactive user approval before proceeding,' providing a clear usage condition. However, it does not explicitly state when to use this tool versus alternatives (e.g., copy_file) or provide when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead FileARead-onlyIdempotent
Read the full contents of a file. Text files are returned as UTF-8 text; binary files are detected automatically and returned as base64.
Args:
path (string): Absolute or relative path to the file.
Returns: file contents as text, or a note that the file is binary with base64 content.
Error Handling:
Returns an error if the path is outside allowed directories or matches a blocked pattern (e.g. .ssh, .aws).
Returns "File or directory not found" if the path does not exist.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the file to read |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly, idempotent, and non-destructive behavior. The description adds value by detailing return format (UTF-8 text or base64) and error conditions (path restrictions, not found). This exceeds what annotations alone provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with clear sections for arguments and error handling. Every sentence adds value, and there is no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (1 parameter, no output schema), the description fully covers return values and error scenarios. It provides sufficient context for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides a description for 'path' that covers its purpose. The description adds 'Absolute or relative path to the file,' which is largely redundant. Schema coverage is 100%, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads the full contents of a file, differentiating between text and binary files. It distinguishes from siblings like read_file_lines and file_info by specifying it returns the entire file content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when full file content is needed, but does not explicitly state when to use this tool over alternatives or provide exclusion conditions. No comparison with sibling tools is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_file_linesRead File LinesARead-onlyIdempotent
Read a specific line range from a file. Useful for large files where reading the whole thing would exceed limits.
Args:
path (string): Path to the file.
start_line (number): 1-indexed starting line (inclusive).
end_line (number): 1-indexed ending line (inclusive).
Returns: the requested lines, each prefixed with its line number.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the file | |
| end_line | Yes | 1-indexed ending line, inclusive | |
| start_line | Yes | 1-indexed starting line, inclusive |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive. Description adds return format ('lines prefixed with line number') and indexing details (1-indexed, inclusive).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise paragraphs: purpose and parameters. Front-loaded with key information. No superfluous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple tool, rich annotations, and 100% schema coverage, description adequately covers usage, parameters, and return format. Lacks error handling notes, but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%; description repeats schema info with slight clarification (1-indexed, inclusive). No new parameter semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Read a specific line range from a file' and distinguishes from reading whole file, which is the sibling tool read_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly mentions usefulness for large files to avoid limits, implying when to use instead of read_file. No explicit when-not, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_commandRun Shell CommandADestructive
Execute a shell command and return its stdout/stderr. ALWAYS requires interactive user approval before running.
Args:
command (string): The command to execute (interpreted by the platform shell β cmd.exe on Windows, bash on Linux).
cwd (string, optional): Working directory. Defaults to the first allowed directory.
timeout (number, optional): Timeout in milliseconds. Default: 30000, max 300000.
Returns: stdout, stderr, and exit code.
Error Handling:
Returns an error if the user declines the approval prompt.
Returns an error if the command exceeds the timeout (process is killed).
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the command | |
| command | Yes | Shell command to execute | |
| timeout | No | Timeout in milliseconds |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint: true), the description adds that the command is killed on timeout, returns error if user declines, and specifies shell interpretation (cmd.exe vs bash). This enriches the behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with clear sections (Args, Returns, Error Handling), concise yet comprehensive, with no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool without output schema, it covers return values, error scenarios, approval requirement, timeout, and shell differences. All critical aspects are addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the description still adds value by stating defaults for cwd and timeout, and the max timeout. These details are not in the schema, aiding the agent in proper usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute a shell command and return its stdout/stderr,' using a specific verb and resource. It also highlights the unique requirement for interactive approval, distinguishing it from sibling tools like run_command_background.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states 'ALWAYS requires interactive user approval,' providing a strong usage guideline. It also covers error handling for user decline and timeout, but does not explicitly mention when not to use or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_command_backgroundRun Command in BackgroundADestructive
Start a long-running command in the background and return immediately with its process ID. ALWAYS requires interactive user approval before running.
Args:
command (string): The command to execute.
cwd (string, optional): Working directory. Defaults to the first allowed directory.
Returns: the process ID (pid), which can be used with list_processes and kill_process.
Note: background processes have no timeout, but they are tracked and can be killed with kill_process. They do not survive this server process restarting (e.g. Claude Desktop being closed and reopened).
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the command | |
| command | Yes | Shell command to execute in the background |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations include destructiveHint=true, readOnlyHint=false, openWorldHint=true, idempotentHint=false. The description adds: 'ALWAYS requires interactive user approval', 'no timeout', 'they are tracked and can be killed with kill_process', and 'they do not survive server restart'. These details go beyond annotations, providing full behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with 'Args:', 'Returns:', and a 'Note:' section. Every sentence adds value, and there is no redundancy. It is concise and front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters, annotations, and no output schema, the description fully covers how to start a background process, what the return value is, process lifecycle, and safety requirements. There are no gaps in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description repeats the parameter names and adds minor details: 'cwd' defaults to the first allowed directory, and 'command' is described but not more than the schema. No additional meaning beyond the schema is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it starts a long-running command in the background and returns immediately with its process ID. The tool name 'run_command_background' is well reflected, and it distinguishes itself from sibling tools like 'run_command' and 'kill_process'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'ALWAYS requires interactive user approval before running,' which is a critical usage guideline. It also mentions that background processes have no timeout and can be killed, providing clear context for when to use this tool. A comparator to 'run_command' would be ideal but is not strictly necessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_contentSearch File ContentsARead-onlyIdempotent
Grep-like search: find a text query across files in a directory, returning matching lines with 2 lines of context before/after.
Args:
directory (string): Base directory to search within.
query (string): Text to search for (case-sensitive, literal substring match).
file_pattern (string, optional): Glob to limit which files are searched (e.g. "**/*.js"). Default: all files.
max_results (number, optional): Cap on returned matches. Default: 50.
Returns: matching lines with file path, line number, and surrounding context.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Text to search for (literal substring, case-sensitive) | |
| directory | Yes | Base directory to search within | |
| max_results | No | Maximum matches to return | |
| file_pattern | No | Glob to limit searched files, e.g. "**/*.js" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and non-destructive behavior. The description adds details: case-sensitive literal substring matching, 2 lines of context, and default max_results, which go beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with purpose, and well-structured with Args and Returns. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers key aspects like query behavior and defaults. It could mention recursive directory search explicitly, but overall it is sufficiently complete given the schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with descriptions. The description adds defaults for file_pattern and max_results, providing additional guidance over the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Grep-like search: find a text query across files in a directory, returning matching lines', which specifies the verb and resource. It distinguishes from sibling tools like search_files (file names) and read_file (single file).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for content search but does not explicitly differentiate from sibling tools like search_files. However, the context is clear enough for an agent to understand when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_filesSearch Files by NameARead-onlyIdempotent
Find files matching a glob pattern within a directory (e.g. "**/.ts", ".log").
Args:
directory (string): Base directory to search within.
pattern (string): Glob pattern to match filenames against.
max_results (number, optional): Cap on returned results. Default: 50.
Returns: a list of matching file paths, relative to the search directory.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | Yes | Glob pattern, e.g. "**/*.ts" | |
| directory | Yes | Base directory to search within | |
| max_results | No | Maximum results to return |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, etc. The description adds that it returns a list of matching file paths relative to the search directory, which is useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with 4 sentences, structured in 'Args' and 'Returns' sections. Every sentence is informative and no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 params, no output schema), the description covers purpose, parameters, and return format adequately. Could be slightly improved by explicitly stating recursion behavior, but the glob example implies it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds value by providing glob pattern examples and a default value for max_results (50). This clarifies usage beyond the schema's field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Find files matching a glob pattern within a directory', specifying a specific verb (find) and resource (files). This distinguishes it from sibling tools like search_content (which searches file contents) and list_directory (which lists directory entries).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context with glob pattern examples and default max_results. It does not explicitly state when not to use or mention alternative tools, but the context is clear enough for a straightforward search tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoGet System InfoARead-onlyIdempotent
Get information about the machine this server is running on: OS, hostname, home directory, Node version, CPU count, and total memory.
Returns: a JSON object with platform details.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds specific details about what information is returned (OS, hostname, etc.), enhancing transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff, front-loaded with the purpose. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and no output schema, the description fully covers what the tool does and returns. It lists the fields included in the output, making it complete for a simple informational tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters; schema coverage is 100%. The description explains the return value (a JSON object with platform details), which compensates for the lack of parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves machine information, listing specific attributes (OS, hostname, etc.), and it is distinct from sibling tools like run_command or read_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving system info but does not explicitly state when to use it versus alternatives or when to avoid it. The context is clear enough, but guidance is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileWrite FileADestructive
Create a new file or overwrite an existing one. Parent directories are created automatically.
Overwriting an EXISTING file requires interactive user approval (elicitation) β the server will pause and ask the connected client to confirm before proceeding.
Args:
path (string): Path to write to.
content (string): Text content to write (UTF-8).
overwrite (boolean, optional): Must be true to overwrite an existing file. Default: false.
Error Handling:
Returns an error without writing if the file exists and overwrite is not true.
Returns an error if the user declines the overwrite approval prompt.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to write to | |
| content | Yes | Text content to write | |
| overwrite | No | Set true to allow overwriting an existing file |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint=true, but description adds critical behavioral detail: overwriting an existing file triggers interactive user approval (elicitation) and the server pauses for confirmation. Also explains error handling for file existence scenarios, adding value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections for description, args, and error handling. Sentences are reasonably concise, though the error handling section could be integrated more succinctly. Overall, every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 parameters, no output schema), the description is thorough: it covers purpose, parameter details, side effects (automatic parent directory creation), interactive behavior, and error cases. No gaps remain for safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds context: overwrite must be true for overwriting, default is false, and content is UTF-8. This clarifies usage beyond the schema's property descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states 'Create a new file or overwrite an existing one', clearly identifying the verb and resource. It distinguishes from siblings like read_file, delete_file, and move_file by focusing on writing/creating files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear use case: create or overwrite files. Explains that overwriting requires interactive approval and the overwrite flag must be true. Does not explicitly state when not to use, but the error handling and sibling list imply alternatives for reading or deletion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
17 tool updates
v1.0.0- First observed
copy_file - First observed
create_directory - First observed
delete_directory - First observed
delete_file - First observed
file_info - First observed
kill_process - First observed
list_directory - First observed
list_processes - First observed
move_file - First observed
read_file - First observed
read_file_lines - First observed
run_command - First observed
run_command_background - First observed
search_content - First observed
search_files - First observed
system_info - First observed
write_file
TDQS
Each tool has a clearly distinct purpose: read_file vs read_file_lines differ by scope; write_file, move_file, copy_file, delete_file, delete_directory are all unique operations; search_files vs search_content are different search types; run_command vs run_command_background vs process management tools are separate; system_info and file_info are metadata distinct from content tools. No overlap.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., read_file, list_directory, search_content, kill_process). No mixing of camelCase or other conventions, making the namespace predictable.
17 tools is slightly above the typical 3-15 range, but each tool covers a distinct operation (file read/write, directory ops, searching, command execution, process management, system info) and the scope justifies the count. It feels well-scoped for a file system server.
The tool set covers all essential file system operations: create, read, update (overwrite), delete for files; directory creation and deletion; move/copy; file and content search; metadata retrieval; and even command execution with process management. No obvious gaps for common tasks.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yoβ¦
Nifty's MCP server β exposes tasks, projects, messages, and files as tools for AI agents.
Driflyte MCP server which lets AI assistants query topic-specific knowledge from web and GitHub.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn enhanced MCP server that grants AI assistants the ability to execute terminal commands on a user's system with improved security controls, designed for use in controlled environments.2MIT
- AlicenseNot gradedqualityDmaintenanceA security-first MCP server that gives AI assistants controlled, safe access to manage remote servers via SSH with whitelisted operations and no generic command execution.MIT
- AlicenseAqualityCmaintenanceAn MCP server that lets an AI assistant run commands and transfer files over SSH without exposing connection details.5MIT
- FlicenseBqualityCmaintenanceA lightweight MCP server that enables AI assistants to interact with the local machine through terminal, filesystem, and Python execution tools.91-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Prabhas125/universal-mcp-fs'
If you have feedback or need assistance with the MCP directory API, please join our Discord server