[TomrroW007]

Description

This pull request updates the src/filesystem/README.md documentation to clarify server startup behavior and configuration auditing for directory access control.

Documentation improvements:

• Added a note explaining that starting the server without path arguments delegates directory access control to the client at runtime, which can hinder auditability. It recommends specifying allowed directories as command-line arguments for a self-contained and auditable configuration.

(Note: Left the registry publishing note intact as per standard template instructions)

Server Details

• Server: filesystem
• Changes to: documentation (README.md)

Motivation and Context

Fixes #4423.

When the filesystem server is launched without path arguments, it correctly relies on the client's roots protocol for scope verification at runtime. However, this behavior makes the access boundary invisible at the config level. This PR adds a note to clarify this behavior and guides users who want an auditable, self-contained config to use explicit path arguments.

How Has This Been Tested?

N/A - This is purely a documentation update.

Breaking Changes

None. Users will not need to update their MCP client configurations.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follows MCP security best practices
• I have updated the server's README accordingly
• I have tested this with an LLM client
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have documented all environment variables and configuration options

Additional context

N/A

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[tarunag10]

This covers the auditability gap from #4423 cleanly: it distinguishes valid argless/root-driven operation from self-contained config review, and points users to explicit path args when the access boundary needs to be visible in config. I do not think a separate docs PR is needed.

[cliffhall]

Thank you for this pull request, and apologies for the long wait for a response.

Since it was opened, the reference servers have been rebuilt for the 2026-07-28 MCP specification (#4857) and released as v2 (2.0.0 on npm for the TypeScript servers, 2026.10.19 on PyPI for the Python servers). The code this PR changes has been replaced, and the behavior it addresses has either been fixed in v2 or no longer exists in the same form.

This is not a judgment on the change or on you; it's a consequence of the code it targets having been replaced. If the problem still happens on v2, please open a fresh issue with the version you're running and steps to reproduce. Note that this repository now accepts contributions as issues rather than pull requests from anyone but its maintainers; see CONTRIBUTING.md.

This is part of the backlog triage in #4875.