Filesystem MCP server: "Access denied - path outside allowed directories"

Your AI tries to open a file through the Filesystem MCP server and gets back this error. It means the file is not inside any folder the server was told about when it started. We reproduced this and the related errors below with the official server (package version 2026.8.31) on Windows in September 2026.

What the error looks like

Asking the server to read a file outside its allowed folder returns:

Access denied - path outside allowed directories: C:\Users\you\other\notes.txt not in C:\Users\you\project

The message shows the path it tried, then the allowed folder or folders. If the second part is empty, no folder was allowed at all (see below).

Fix it: allow the folder

The allowed folders are the arguments after the package name. To allow another folder, add it at the end:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/your/project",
        "/path/to/another/folder"
      ]
    }
  }
}

Every folder you add is fully readable and writable by the AI, so add only what you need. Then restart your client so it starts the server again with the new list. In Claude Desktop, fully quit it first. The Filesystem server page has this config for all three clients.

Check what is allowed

The server has a tool called list_allowed_directories. Ask your AI: "Which directories can you access through the filesystem server?" It answers with the folders the server actually started with, such as:

Allowed directories: C:\Users\you\project

If the folder you expect isn't in that list, the config change didn't take effect. Check that you edited the right file and restarted the client.

Paths that are still blocked

• .. does not get you out. A path like project/../other/notes.txt is resolved first, and then refused if it lands outside. We tried it and got the same "Access denied" message.
• Relative paths work, from the allowed folder. With one allowed folder, a relative path like a.txt was read from inside it. A relative path that climbs out with .. was refused.
• Writing is checked the same way. A file created outside the allowed folders was refused with the same message.

Errors that look similar but aren't

"ENOENT: no such file or directory"

This is not a permissions problem. The file is inside an allowed folder but doesn't exist, usually a typo in the name. Example: ENOENT: no such file or directory, open 'C:\Users\you\project\nope.txt'.

The server disconnects right away ("Connection closed")

If none of the folders in args exist, the server exits at startup, so your client just sees a failed connection. Run it by hand to see why (see fixing connection errors). We got:

Warning: Cannot access directory C:\path\to\your\project, skipping
Error: None of the specified directories are accessible

This is what happens when the /path/to/your/project placeholder from a tutorial is left in the config. A mistyped folder name gives the same two lines. Replace it with a real folder.

It starts, but everything is denied

When we started the server with no folder at all, it did start, but every file request failed with the "Access denied" message and an empty list of allowed folders. Its README says clients that support "roots" can supply folders dynamically, and our test client does not. If your client doesn't, always pass at least one folder in args.

Windows paths

Both forward slashes (C:/Users/you/project) and backslashes worked for the allowed folder in our test, and the server reported it back with backslashes. In JSON, a backslash must be doubled (C:\\Users\\you\\project), so forward slashes are easier.