wsl-files
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@wsl-filesfind all .py files under ~/dev/proj"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
wsl-files
A small local MCP server that lets Claude Desktop's Cowork, on Windows, read and write your files inside WSL.
It runs inside WSL over stdio, and Claude Desktop starts it with wsl.exe.
Why this exists
Cowork on Windows can't attach a folder that lives in a WSL distro. Every way in fails:
A
\\wsl.localhost\<distro>\...subfolder is rejected up front: "Network (UNC) paths are not supported here."The
\\wsl.localhostfolder itself, a mapped drive (net use), asubstdrive, or a symlink in your Windows home folder: the picker accepts them, then the message fails with "Some folders couldn't be added."
That leaves WSL developers without Cowork for any of their code. Microsoft's own advice is to keep projects on the Linux filesystem for speed (WSL docs).
The feature request is anthropics/claude-code#99303. It re-files #61003, which a bot closed as stale with no maintainer response. Claude Desktop's Code tab does handle WSL folders; Cowork doesn't.
Scheduled tasks hit the same wall: the "New scheduled task" form rejects a WSL folder as "a protected location". The Code tab's WSL sessions would be the way around that, but as of 2026-10-17 (Desktop 2.42304.0.0) they fail to start with "Couldn't upload to the remote (server binary) ... [ENOENT]" (#101998).
Cowork can still use local MCP servers through Claude Desktop, and an MCP server can run inside WSL. This one does the file work there and hands Cowork the results.
Why not the official filesystem server
@modelcontextprotocol/server-filesystem works, but two things made it a poor fit here:
No server-side deny list. Anything under an allowed folder is readable,
.envfiles included; itsexcludePatternsis a per-call option for searches, chosen by the client. This server refuses secrets files outright and redacts key-shaped strings.The client can replace its folders. Per its README, roots sent by the client "completely replace any server-side Allowed directories". Here the folders are fixed on the server side, whatever the client sends.
This one also accepts the Windows spellings Cowork tends to send (\\wsl.localhost\..., W:\..., C:\Users\<user>\dev\...).
If Anthropic ships WSL folders in Cowork, you won't need this.
Related MCP server: @modelcontextprotocol/server-wsl
What it can do
Tool | What it does |
| Shows the folders it may use |
| Reads a text file with line numbers, in pages ( |
| Creates or replaces a file, creating parent folders |
| Replaces exact text: one match, or every match with |
| Lists a folder, up to 5 levels deep |
| Finds files by glob ( |
| Regex search through file contents |
| Copies any file, binary too, into one Windows staging folder so the client's own tools can open it |
| Copies a file from that staging folder back into WSL |
There is no delete and no move, on purpose. Text tools can't handle binary files (docx, pdf, images); the two copy tools move those through the staging folder, and they're off unless WSL_FILES_STAGING is set.
What it refuses
Anything outside the roots. The default root is
~/dev. A symlink that points outside is refused too, and paths are checked after resolving symlinks.Secrets files (
.env,token.json,*.creds.json, SSH keys, cookies and similar). It won't read, write, or search them. The patterns are a copy of a Claude Code guard hook's, so both refuse the same files.Key-shaped strings in output (API keys, tokens, private keys) come back as
[redacted <kind>].Writes inside
.git.Edits to non-UTF-8 files, and binary files for any reading.
Every write and edit is logged as one JSON line in ~/.local/state/wsl-files/changes.log.
Paths it understands
All of these name the same file:
~/dev/proj/README.md/home/<user>/dev/proj/README.mdproj/README.md(relative to the first root)\\wsl.localhost\<distro>\home\<user>\dev\proj\README.md(also\\wsl$\...)W:\home\<user>\dev\proj\README.md(a drive letter mapped to the WSL root; set it withWSL_FILES_WSL_DRIVE)C:\Users\<user>\dev\proj\README.md(a Windows junction to~/dev)
Setup
cd ~/dev/cowork-wsl-files
uv venv && uv pip install -e ".[dev]"
git config core.hooksPath .githooks
.venv/bin/pytestIn %APPDATA%\Claude\claude_desktop_config.json, under mcpServers:
"wsl-files": {
"command": "wsl.exe",
"args": ["-d", "<distro>", "--", "/home/<user>/dev/cowork-wsl-files/scripts/run-server.sh"]
}Restart Claude Desktop afterwards.
Settings
Put them in config.local in the repo folder (copy config.example). scripts/run-server.sh reads it. Environment variables set in the Claude Desktop config don't work here: they stay on the Windows side and wsl.exe doesn't pass them in.
Variable | Default | Meaning |
|
| Allowed folders, separated by |
|
| Windows drive letter mapped to the WSL root |
|
| User in |
|
| Where |
| unset (copy tools off) | Windows folder for the copy tools; a Windows spelling works |
Available Tools
9 toolscopy_from_windowsADestructive
Copy a file you made in the Windows staging folder (binary too) to a path in WSL.
name: the file inside the staging folder (a name, a sub/path, or its full Windows path). path: where it goes in WSL (same rules as write_file).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the agent knows this can overwrite. The description adds useful context not in the annotations — that binary files are supported and that the source lives in a staging folder — but says nothing about overwrite behavior at the destination, which is the main reason destructiveHint would be set.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences front-loaded with the action, followed by compact per-parameter notes. No redundancy and nothing that fails to earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values need no explanation, and annotations cover the safety profile. For a two-parameter copy tool the description is nearly complete; the only real gap is destination-overwrite behavior, which is left to the destructiveHint annotation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, and it does: 'name' is explained as a bare name, sub-path, or full Windows path within the staging folder, and 'path' is tied to write_file's path rules. This meaningfully compensates for the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and both endpoints of the operation: copy a file from the Windows staging folder (including binary) to a path in WSL. This cleanly distinguishes it from the sibling copy_to_windows, which moves in the opposite direction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies the context clearly — use this when you made a file in the Windows staging folder and need it inside WSL — and the 'same rules as write_file' reference ties path semantics to a known sibling. It stops short of an explicit 'use copy_to_windows for the reverse' statement, but the direction is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
copy_to_windowsADestructive
Copy any file (binary too: docx, pdf, png, .skill) from WSL into the Windows staging folder, where your own file tools can open it. Off unless the server has a staging folder set.
path: the file in WSL. name: file name (or sub/path) inside the staging folder; empty keeps the file's own name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds real context beyond the annotations: binary-file support, the existence and role of the staging folder, and the server-side precondition that the feature is disabled without one. Since destructiveHint=true, it would be stronger if it disclosed overwrite behavior when 'name' collides with an existing staged file, which is the main unstated risk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and precondition are front-loaded in the first two sentences, and the parameter notes are compact. The two inline parameter lines are a slightly clunky structure but every line carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. Coverage of purpose, precondition, binary support, and both parameters is sufficient for correct invocation; only failure/overwrite behavior is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage the description must carry the burden, and it mostly does: 'path' is identified as the file in WSL, and 'name' is explained as a file name or sub/path inside the staging folder with the empty-default behavior spelled out ('empty keeps the file's own name'). Only the accepted path syntax (absolute vs relative, backslash vs forward slash) is left unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (copy) plus the exact resource and direction: a WSL file into the Windows staging folder. It further narrows scope with binary formats (docx, pdf, png, .skill), which makes it trivially distinguishable from the sibling copy_from_windows and the read/write_file family.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear usage context (use it so 'your own file tools can open' the file) and an explicit precondition: 'Off unless the server has a staging folder set.' It does not explicitly name copy_from_windows as the counterpart for the reverse direction, so routing is implied by naming rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_fileADestructive
Replace exact text in a file. old_string must appear exactly once unless replace_all is true.
path: the file to change. old_string: the exact text to find (copied from read_file output, without line numbers). new_string: the text to put in its place. replace_all: replace every occurrence instead of requiring a single one.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| new_string | Yes | ||
| old_string | Yes | ||
| replace_all | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the safety profile is covered. The description adds the non-obvious failure precondition that old_string must occur exactly once unless replace_all is true, which is real behavioral value beyond the annotations. It stops short of describing what happens on no-match/multi-match failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core behavior and the critical uniqueness rule in the first sentence, then uses four tight lines to define parameters. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the main error condition. Remaining gaps are minor: path format (relative vs absolute), behavior when old_string is absent, and the read-before-edit requirement are left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden, and it defines all four parameters in prose. The 'without line numbers' detail for old_string is genuinely clarifying, though 'path: the file to change' adds little beyond the parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Replace exact text in a file') and the exact-match semantics imply it is a surgical edit rather than a full rewrite, which separates it from write_file. However, it never names or contrasts with its closest sibling write_file explicitly, so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical '(copied from read_file output, without line numbers)' implies a read-then-edit workflow, which is useful. But there is no explicit when-to-use-this vs write_file guidance and no statement of preconditions such as the file needing to exist or have been read first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_filesARead-only
Find files by name with a glob such as '.md', 'NOW.md' or 'docs/**/.py'.
pattern: the glob, matched against the path relative to path (a pattern without / also matches bare file names).
path: the folder to look in; empty means the first root.
max_results: stop after this many.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| pattern | Yes | ||
| max_results | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful matching behavior ('pattern without / also matches bare file names'; 'path empty means the first root') and the stopping condition, but says nothing about result ordering, error behavior on a missing path, or scoping beyond the first root.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded lead sentence followed by one terse line per parameter; no filler, and the examples appear before the mechanics. The parameter lines are telegraphic but each still earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and all three parameters are documented in the description despite 0% schema coverage. What remains thin is error/edge-case behavior, which is minor for a read-only file finder.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load and largely does: all three parameters are explained, including what the pattern is matched against, the meaning of an empty path, and what max_results truncates. It stops short of stating the default values or whether max_results counts matches or scanned entries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Find files by name') and reinforces it with concrete glob examples ('*.md', 'docs/**/*.py'). An agent can distinguish it from content-oriented siblings like `search` or `list_dir` from the glob semantics, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied clearly by the glob examples and the pattern-vs-path distinction, so an agent can infer that this is for name matching rather than directory enumeration. However it never states when to prefer this over `list_dir` or `search`, nor any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dirARead-only
List a folder: subfolders first (ending in /), then files with their sizes.
path: the folder; empty means the first root (~/dev). depth: how many levels to show (1-5). .git, node_modules, .venv and caches are not entered.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| depth | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, openWorldHint=false), but the description adds genuinely useful behavior: recursion depth is capped at 1-5 and .git, node_modules, .venv and caches are deliberately not entered, which materially changes what an agent will see. Gaps remain on error handling (e.g. nonexistent path) and symlink behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One line of purpose followed by two compact parameter notes; front-loaded and every sentence adds information. No filler or restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, yet the description still usefully documents result ordering. Both parameters are covered and the traversal exclusions are stated; the only shortfall is unstated failure behavior for bad paths or depths.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden and largely meets it: path defaults to the first root (~/dev) when empty, and depth is bounded to 1-5 levels. Only the 'depth' interplay with the excluded-directory behavior and out-of-range values is unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List a folder') and even specifies the output shape: subfolders first with trailing '/', then files with sizes. That distinguishes it from read_file and search, though it never explicitly names the closest sibling list_roots as a contrasting option.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied — an agent can infer this is for browsing a directory tree rather than finding files by name. There is no explicit 'use this when... instead of find_files/search/list_roots' statement, so routing among the eight siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_rootsARead-only
The folders this server may read and write. Every other path is refused.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint=true and openWorldHint=false, so the safety profile is known. The description adds genuinely new behavioral context beyond the annotations: the tool defines an access boundary, and paths outside it are refused by the server — useful for predicting failure modes of sibling file tools.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The resource identification comes first and the constraining rule second, which is the correct front-loading for an access-boundary tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and there are no parameters to document. For a simple read-only enumeration the description covers what the list represents, though it could note whether the result set is static or configuration-dependent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. There is nothing parameter-wise for the description to compensate for, and schema description coverage is 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource precisely — the server's permitted root folders — and the second sentence adds the boundary rule. It is clear what an agent gets back, though it lacks an explicit verb like 'list' and never names a sibling to contrast against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Every other path is refused' implies this should be consulted before passing paths to read_file/write_file, but that inference is left to the agent. There is no explicit when-to-call or when-not-to-call statement, and no sibling is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileARead-only
Read a text file. Each line comes back as ''.
path: the file (~/dev/..., an absolute WSL path, a Windows spelling of one, or relative to the first root). offset: first line to return, counting from 1. limit: how many lines to return.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| limit | No | ||
| offset | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds genuinely useful behavior beyond that: the returned line format ('<number><tab><text>') and the accepted path spellings (WSL absolute, Windows-style, or relative). It is silent on encoding, binary files, and error behavior for missing paths.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short, front-loaded sentences: the core action and output shape first, then one line per parameter. No filler, no restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value documentation is not required, yet the description still states the line-numbering format, which helps the agent parse results. Given the tool's simplicity, the only meaningful omissions are default values and failure behavior for non-existent or unreadable files.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the burden and it does: path lists the accepted path forms, offset is defined as 1-based line numbering, and limit is defined as a line count. Every parameter gets meaning beyond its bare name, fully compensating for the empty schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource ('Read a text file') and immediately specifies the output format, so the operation is unambiguous. It does not explicitly contrast itself with siblings like write_file, edit_file, or search, but the verb makes the distinction obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'Read a text file' and by the offset/limit paging semantics, which tell the agent how to read a slice rather than the whole file. There is no explicit when-to-use/when-not guidance, no mention that this is unsuitable for binary files, and no pointer to search or find_files for locating content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchARead-only
Search file contents with a regular expression. Returns 'file:line: text' for each match.
pattern: a Python regular expression. path: a folder or a single file; empty means the first root. Narrow it: ~/dev is large. glob: only search files whose relative path matches this glob, e.g. '*.md'. ignore_case: match regardless of case. max_results: stop after this many matching lines.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | ||
| path | No | ||
| pattern | Yes | ||
| ignore_case | No | ||
| max_results | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered structurally. The description adds the match-line output format and max_results truncation behavior, but says nothing about recursion depth, performance cost beyond the 'large' aside, or error behavior on bad regex.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and return format are front-loaded in the first two sentences, followed by a compact per-parameter list. Nothing is padded, though the parameter block reads as a flat enumeration rather than prioritized guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need no explanation, and all five params are addressed. Defaults (max_results=100, empty path) are only partially surfaced in prose, leaving minor gaps for a 5-param search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load, and it documents all five parameters. It adds genuinely useful non-obvious semantics ('empty means the first root', glob matches relative path), though a couple entries (ignore_case) are near-tautological restatements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Search), resource (file contents), and mechanism (regular expression), and even specifies the return shape ('file:line: text'). 'File contents' cleanly distinguishes it from the sibling find_files (name-based) without needing to name it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Offers an implicit scoping hint ('Narrow it: ~/dev is large') and explains what each filter does, but never states when to reach for this tool versus find_files or read_file, nor any exclusions. Usage is implied rather than directed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileADestructiveIdempotent
Create a file or replace it whole. Missing parent folders are created.
path: the file to write. content: the complete new contents.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and readOnlyHint=false, so the safety profile is covered. The description adds real context beyond that: the whole-file replacement semantics (existing content is destroyed, not merged) and the automatic creation of missing parent folders, which no annotation states.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short lines, zero waste, with the core action and the parent-folder side effect front-loaded before the parameter glosses. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the destructive/idempotent profile. What remains is minor: no path format guidance and no explicit pointer to edit_file, but the definition is sufficient to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden for both parameters. "content: the complete new contents" usefully reinforces that the value must be the entire file rather than a patch, but "path: the file to write" is a near-tautology and no format, encoding, or relative-vs-absolute guidance is given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Create a file or replace it whole" is a specific verb+resource with a clear scope qualifier that separates it from the sibling edit_file, which implies partial modification. It stops short of naming that sibling explicitly, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "replace it whole" hints at when this is appropriate (full-file rewrites vs. incremental edits), but there is no explicit when-to-use/when-not guidance and the sibling edit_file is never named. Usage must be inferred from the contrast.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.1.0- First observed
copy_from_windows - First observed
copy_to_windows - First observed
edit_file - First observed
find_files - First observed
list_dir - First observed
list_roots - First observed
read_file - First observed
search - First observed
write_file
TDQS
Scored across 9 tools
Tools are clearly separated by action and resource: reading, writing, editing, listing, finding, searching, and Windows staging copies each have a distinct purpose. No two tools overlap ambiguously.
Most names follow a verb_noun pattern (read_file, write_file, list_dir, find_files) or verb_prep_noun (copy_to_windows). The lone 'search' is just a verb, a minor deviation from the otherwise consistent convention.
9 tools is well within the ideal 3–15 range for a file-access server. Each tool covers a distinct capability without redundancy.
Core read, write, edit, list, find, search, and cross-boundary copy operations are present. Delete and move/rename are missing, limiting full lifecycle coverage, but the main file workflows are supported.
Related MCP Connectors
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Connect ChatGPT, Claude, Cursor or VS Code to your Windows PC: files, terminal, browser, apps.
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Related MCP Servers
- AlicenseAqualityBmaintenanceProvides Claude Desktop with direct access to your local file system for development tasks, enabling file operations (read, write, edit), directory browsing, command execution, and codebase search within a configured projects directory.6MIT
- AlicenseAqualityCmaintenanceEnables Claude Desktop to interact with Windows Subsystem for Linux (WSL) environments, allowing command execution, file management, and distribution inspection from natural language.7MIT
- AlicenseAqualityBmaintenanceEnables AI clients to inspect and carefully edit a bounded local workspace via stdio, with a read-only default, conflict-safe updates, and no network listener or telemetry.102Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables reading, editing, and running commands on a remote SSH host through Claude Code, with path-scoping and command filtering for safety.MIT