Filesystem

io.github.fieldcure由 GitHub 账号 fieldcure 发布v1.1.2更新于 Oct 24, 2026

Secure MCP server for sandboxed filesystem operations with document parsing support.

已验证STDIO仅桌面文件与存储知识与记忆

概览

AI 生成的概览

一个本地 MCP 服务器，让 AI 助手在指定允许目录内以沙箱方式读取、写入、搜索文件，并把文档转换为 Markdown。

可以做什么
读取文件，包括一次读取多个文件、读取指定行范围，以及以 base64 返回二进制文件；将受支持的文档单个或批量转换为磁盘上的 Markdown 文件。创建、覆盖、追加、查找替换、复制、移动和删除文件与目录。列出目录内容、递归创建目录、显示可配置深度的目录树。按 glob 模式查找文件、在文件内容中带行号搜索文本，并读取文件或目录的元数据。
适用场景
适合助手需要处理本地项目或文档目录的场景：读写源码或文本文件、把文档转换为 Markdown、在目录树中搜索。沙箱机制将其限制在你明确允许的目录内。
运行要求
以 stdio 方式作为本地进程运行；需要 .NET 8.0 运行时或更高版本，以及 FieldCure.Mcp.Filesystem dotnet 工具（或从源码构建）。允许的目录通过命令行参数传入，之后可通过 MCP roots 协议替换。
安装前请注意
它可以在允许目录内写入、覆盖、追加、移动和删除文件与目录，因此只应授予你愿意被修改的文件夹。Markdown 转换会向磁盘写入新文件。访问范围受配置的沙箱限制；roots 列表为空时拒绝所有文件访问。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Filesystem，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

FieldCure MCP Filesystem Server

[NuGet] [License: MIT]

A secure Model Context Protocol (MCP) server that exposes local filesystem operations to AI clients. Built with C# and the official MCP C# SDK.

Features

  • 17 filesystem tools: read, write, append, delete, search, copy, move, convert-to-markdown, and more
  • Sandboxed access: all operations restricted to explicitly allowed directories
  • MCP roots protocol: clients can change allowed directories at runtime without restarting the server
  • Security hardened: path traversal prevention, symlink resolution, NTFS ADS blocking, Windows reserved name rejection
  • Atomic writes: temp-file-then-rename pattern prevents data corruption
  • Binary detection: automatically returns base64 for binary files, UTF-8 for text
  • Built-in document parsing: supported document formats can be read directly and converted to markdown on disk
  • Stdio transport: standard MCP subprocess model via JSON-RPC over stdin/stdout

Installation

dotnet tool

bash
dotnet tool install -g FieldCure.Mcp.Filesystem

From source

bash
git clone https://github.com/fieldcure/fieldcure-mcp-filesystem.gitcd fieldcure-mcp-filesystemdotnet build

Requirements

Configuration

Claude Desktop

json
{  "mcpServers": {    "filesystem": {      "command": "fieldcure-mcp-filesystem",      "args": [        "C:\\Users\\me\\Documents",        "C:\\Projects"      ]    }  }}

VS Code

json
{  "servers": {    "filesystem": {      "command": "fieldcure-mcp-filesystem",      "args": [        "${workspaceFolder}"      ]    }  }}

Tools

File Operations

ToolDescription
read_fileRead file contents (text as UTF-8, binary as base64)
read_multiple_filesRead multiple files at once with per-file error handling
read_file_linesRead a specific range of lines
convert_to_markdownConvert one supported document file into a markdown file on disk
convert_directory_to_markdownBatch-convert supported document files in a directory to markdown files
write_fileCreate or overwrite a file with atomic write
append_fileAppend content to end of file with auto-newline
modify_fileFind and replace text (plain text or regex)
copy_fileCopy a file or directory recursively
move_fileMove or rename a file or directory
delete_fileDelete a file or directory

Directory Operations

ToolDescription
list_directoryList contents with type markers, sizes, and dates
create_directoryCreate a directory recursively
directory_treeHierarchical tree view with configurable depth

Search & Info

ToolDescription
search_filesFind files by glob pattern
search_within_filesSearch text content across files with line numbers
get_file_infoFile or directory metadata

MCP Roots Protocol

The server supports the MCP roots protocol for runtime directory changes. When the client changes roots:

  1. The server requests the updated roots list.
  2. Allowed directories are replaced entirely.
  3. CLI args provide the initial sandbox.
  4. An empty roots list means all file access is denied.

Security Model

All paths are validated through IPathValidator before any filesystem operation:

  1. Allowed directories define the sandbox boundary.
  2. . and .. are normalized via Path.GetFullPath().
  3. Symlinks must resolve within allowed directories.
  4. Prefix matching is directory-separator-aware.
  5. NTFS alternate data streams are blocked.
  6. Windows reserved names are rejected.
  7. Allowed directory updates are thread-safe.

The markdown conversion tools validate both source and output paths through the same sandbox rules. They write converted markdown directly to disk instead of returning full document text through MCP, which is usually more token-efficient than read_file plus write_file.

Project Structure

text
src/FieldCure.Mcp.Filesystem/|- Program.cs|- Security/|  |- IPathValidator.cs|  \- PathValidator.cs|- Tools/|  |- FileOperationTools.cs|  |- DirectoryTools.cs|  \- SearchTools.cs\- Utilities/   |- EncodingDetector.cs   \- FileSize.cs

Development

bash
dotnet builddotnet testdotnet pack src/FieldCure.Mcp.Filesystem -c Release

Limitations

SupportedNot Yet Supported
Text file read/write (UTF-8)Non-UTF-8 encoding auto-detection
Binary file detection + base64Streaming for very large files (>100 MB)
Atomic writesFile watching / change notifications
Glob pattern searchFull-text indexing
Regex find-and-replaceMulti-file transactional writes
Symlink resolutionCross-platform symlink creation
MCP roots protocolHTTP transport
Document text extraction / markdown conversion for formats supported by DocumentParsersOCR for scanned documents

See Also

Part of the AssistStudio ecosystem.

License

MIT

来源：README.md，提交 75e0e0c

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v1.1.2最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分