How to have AI read only specific folders with MCP

The rule that counts

The filesystem server sees only the folders you pass to it. If you give it a precise folder, all the rest of the computer stays invisible; if out of laziness you give it a folder high up (like the entire user folder), you're opening to it everything underneath. The difference between safe access and dangerous access is one line of configuration: the path you write.

How to do it

It applies to any assistant that supports MCP; only where the file lives changes.

List the precise folders. Decide which folders the AI really needs. Better two or three specific folders than one large one that contains them all.
Write them in the server, one by one. The working syntax (here two folders):

{
  "mcpServers": {
    "work": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourname/Documents/clients",
        "/Users/yourname/Documents/projects"
      ]
    }
  }
}

Each path at the end is an allowed folder. The AI will be able to read inside clients and projects, but nowhere else on the disk.

For read-only, use a dedicated server. The official filesystem server also allows modifying. If you want the AI to read and that's it, there are versions of the server designed for read-only: look for a "read-only" filesystem server and use it instead of the standard one, so writing is excluded at the root.
Restart and verify. After the restart, ask the AI: "which folders can you see?". It should list only the ones you put in. If it names others, you've given a path that's too broad.

A concrete example

Marco is an accountant and wants the AI to help him only with two clients' files, without touching the rest. In the configuration file he puts the filesystem server with two paths: client A's folder and client B's. Not the whole "clients" folder, which also contains another thirty confidential files.

He restarts and asks "which folders do you see?": the assistant lists only the two indicated. Marco works at ease, knowing the other clients stay invisible to the AI. When he's done with those two, he changes the paths to two other names. The access stays always restricted to the minimum necessary, a pair of folders at a time.

When it does NOT work (and how to fix it)

If you realize you've given access to too much

If on asking "which folders do you see?" the AI names more than you wanted, you've put a path too high up. Replace it with the precise subfolders you need and restart. Better to add two specific folders than to leave one that swallows them all.

If you need to add a folder later

You don't have to redo everything: open the file, add the new path to the list (separated by a comma, in quotes) and restart the assistant. The new folder sits alongside the others without touching them.

If you want it to read but fear it'll modify

As long as you use the standard server, the AI can also write in the indicated folders, albeit asking for confirmation first. If that confirmation isn't enough for you, switch to a read-only filesystem server: it removes the possibility of modifying entirely, instead of leaving it to a single "yes" given in haste.

A tip from someone who really uses it

Treat the paths as permissions and reread them every now and then. It's easy, over time, to add folders and forget about them, until the AI sees half the computer. Once a month open the file and ask yourself, for each folder listed: "does the AI still need to see this?". Remove what's not needed. The safest folder is the one you never granted.

Frequently asked questions

Can I give access to multiple folders that aren't near each other?

Yes. You can list paths of folders in different places on the disk, one after another in the server's list. They don't have to be in the same location: each is a permission of its own, and the AI sees only the set of the ones you wrote.

Can the AI leave the folders I indicated?

No, and that's the point of the filesystem server: the operations are confined to the allowed folders. It can't go up to the parent folder or snoop elsewhere. This boundary is exactly the guarantee that makes it safe to give it access to a part of the computer.

Is limiting the folders enough to be at ease?

Here's the misunderstanding to clear up: limiting access is the most important defense, but not the only one. What also counts is where the server comes from (use only ones from reliable sources) and what the files you have it read contain, because a trap text inside a document can still try to give instructions to the AI. The restricted folder reduces the possible damage greatly; combined with trusted servers and read-only, it really keeps you protected.

Quick answer