Filesystem

io.github.fieldcure由 GitHub 帳號 fieldcure 發布v1.1.2更新於 Oct 24, 2026

Secure MCP server for sandboxed filesystem operations with document parsing support.

已驗證STDIO僅桌面檔案與儲存知識與記憶

概覽

AI 產生的概覽

一個本機 MCP 伺服器，讓 AI 助理在指定允許目錄內以沙箱方式讀取、寫入、搜尋檔案，並將文件轉換為 Markdown。

可以做什麼
讀取檔案，包括一次讀取多個檔案、讀取指定行範圍，以及以 base64 回傳二進位檔案；將支援的文件單獨或批次轉換為磁碟上的 Markdown 檔案。建立、覆寫、附加、尋找取代、複製、移動和刪除檔案與目錄。列出目錄內容、遞迴建立目錄、顯示可設定深度的目錄樹。依 glob 模式尋找檔案、在檔案內容中帶行號搜尋文字，並讀取檔案或目錄的中繼資料。
適用情境
適合助理需要處理本機專案或文件目錄的情境：讀寫原始碼或文字檔、將文件轉換為 Markdown、在目錄樹中搜尋。沙箱機制會將其限制在你明確允許的目錄內。
執行需求
以 stdio 方式作為本機程序執行；需要 .NET 8.0 執行階段或更新版本，以及 FieldCure.Mcp.Filesystem dotnet 工具（或從原始碼建置）。允許的目錄透過命令列參數傳入，之後可透過 MCP roots 協定替換。
安裝前請注意
它可以在允許目錄內寫入、覆寫、附加、移動和刪除檔案與目錄，因此只應授予你願意被修改的資料夾。Markdown 轉換會將新檔案寫入磁碟。存取範圍受設定的沙箱限制；roots 清單為空時會拒絕所有檔案存取。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Filesystem，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

FieldCure MCP Filesystem Server

[NuGet] [License: MIT]

A secure Model Context Protocol (MCP) server that exposes local filesystem operations to AI clients. Built with C# and the official MCP C# SDK.

Features

  • 17 filesystem tools: read, write, append, delete, search, copy, move, convert-to-markdown, and more
  • Sandboxed access: all operations restricted to explicitly allowed directories
  • MCP roots protocol: clients can change allowed directories at runtime without restarting the server
  • Security hardened: path traversal prevention, symlink resolution, NTFS ADS blocking, Windows reserved name rejection
  • Atomic writes: temp-file-then-rename pattern prevents data corruption
  • Binary detection: automatically returns base64 for binary files, UTF-8 for text
  • Built-in document parsing: supported document formats can be read directly and converted to markdown on disk
  • Stdio transport: standard MCP subprocess model via JSON-RPC over stdin/stdout

Installation

dotnet tool

bash
dotnet tool install -g FieldCure.Mcp.Filesystem

From source

bash
git clone https://github.com/fieldcure/fieldcure-mcp-filesystem.gitcd fieldcure-mcp-filesystemdotnet build

Requirements

Configuration

Claude Desktop

json
{  "mcpServers": {    "filesystem": {      "command": "fieldcure-mcp-filesystem",      "args": [        "C:\\Users\\me\\Documents",        "C:\\Projects"      ]    }  }}

VS Code

json
{  "servers": {    "filesystem": {      "command": "fieldcure-mcp-filesystem",      "args": [        "${workspaceFolder}"      ]    }  }}

Tools

File Operations

ToolDescription
read_fileRead file contents (text as UTF-8, binary as base64)
read_multiple_filesRead multiple files at once with per-file error handling
read_file_linesRead a specific range of lines
convert_to_markdownConvert one supported document file into a markdown file on disk
convert_directory_to_markdownBatch-convert supported document files in a directory to markdown files
write_fileCreate or overwrite a file with atomic write
append_fileAppend content to end of file with auto-newline
modify_fileFind and replace text (plain text or regex)
copy_fileCopy a file or directory recursively
move_fileMove or rename a file or directory
delete_fileDelete a file or directory

Directory Operations

ToolDescription
list_directoryList contents with type markers, sizes, and dates
create_directoryCreate a directory recursively
directory_treeHierarchical tree view with configurable depth

Search & Info

ToolDescription
search_filesFind files by glob pattern
search_within_filesSearch text content across files with line numbers
get_file_infoFile or directory metadata

MCP Roots Protocol

The server supports the MCP roots protocol for runtime directory changes. When the client changes roots:

  1. The server requests the updated roots list.
  2. Allowed directories are replaced entirely.
  3. CLI args provide the initial sandbox.
  4. An empty roots list means all file access is denied.

Security Model

All paths are validated through IPathValidator before any filesystem operation:

  1. Allowed directories define the sandbox boundary.
  2. . and .. are normalized via Path.GetFullPath().
  3. Symlinks must resolve within allowed directories.
  4. Prefix matching is directory-separator-aware.
  5. NTFS alternate data streams are blocked.
  6. Windows reserved names are rejected.
  7. Allowed directory updates are thread-safe.

The markdown conversion tools validate both source and output paths through the same sandbox rules. They write converted markdown directly to disk instead of returning full document text through MCP, which is usually more token-efficient than read_file plus write_file.

Project Structure

text
src/FieldCure.Mcp.Filesystem/|- Program.cs|- Security/|  |- IPathValidator.cs|  \- PathValidator.cs|- Tools/|  |- FileOperationTools.cs|  |- DirectoryTools.cs|  \- SearchTools.cs\- Utilities/   |- EncodingDetector.cs   \- FileSize.cs

Development

bash
dotnet builddotnet testdotnet pack src/FieldCure.Mcp.Filesystem -c Release

Limitations

SupportedNot Yet Supported
Text file read/write (UTF-8)Non-UTF-8 encoding auto-detection
Binary file detection + base64Streaming for very large files (>100 MB)
Atomic writesFile watching / change notifications
Glob pattern searchFull-text indexing
Regex find-and-replaceMulti-file transactional writes
Symlink resolutionCross-platform symlink creation
MCP roots protocolHTTP transport
Document text extraction / markdown conversion for formats supported by DocumentParsersOCR for scanned documents

See Also

Part of the AssistStudio ecosystem.

License

MIT

來源：README.md，提交 75e0e0c

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.1.2最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分