Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Filesystem README recommends deprecated MCP Roots protocol for restricting directory access

Open Beginner friendly
  • Is something wrong?
#4,844 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
documentation

Research direction

Start with the README.md section on restricting filesystem access via Roots and compare its guidance with the referenced MCP deprecated-features specification. Check whether the server implementation uses ListRootsRequest, as the issue suggests, and note any follow-up needed. Done means the README documents current alternatives, labels retained Roots guidance as legacy if applicable, and clearly describes the supported access configuration.

Written by the indexing model from the issue text.

Description

Summary

The README.md contains a section recommending the use of the MCP Roots protocol as the mechanism for restricting which directories the filesystem server can access. However, according to the current official MCP specification, Roots is deprecated as of protocol version 2026-07-28 and scheduled for removal.

Source: MCP Specification — Deprecated features

Why this matters

  • New users following the README will adopt a deprecated mechanism that is scheduled for removal from the protocol.
  • Roots-based access restriction may not work with newer MCP clients, so the documented guidance will break over time.
  • The project's documented access-control story should stay aligned with the current specification.

Suggested changes

  • Update the README section to stop recommending Roots as the primary way to restrict directory access
  • Document the alternatives recommended by the spec:
    • passing directories/files via tool parameters
    • resource URIs
    • server configuration (e.g., allowed directories passed via CLI arguments, which the server already supports)
  • If any Roots-related guidance or behavior is kept, mark it explicitly as legacy/deprecated with a pointer to the migration guidance
  • Check whether the server implementation itself relies on Roots (e.g., ListRootsRequest) and, if so, open a follow-up issue for migrating away from it

References

Dominant language
TypeScript
Stars
90.5k
Forks
11.7k
Avg merge
5d 19h
Merged PRs (30d)
6

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/servers

All issues in modelcontextprotocol/servers

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.