Practical MCP with FastMCP & LangChain

Roots (Client Side)

Roots define where a server is allowed to operate in the local filesystem. They are boundaries, nothing more, nothing less.

In MCP, the client (for example, an IDE, desktop app, or development tool) decides which folders a server can see. Those folders are called roots. The server cannot assume access to the whole machine. It can only work inside the roots explicitly exposed by the client.

Roots are therefore:

• Chosen by the client
• Controlled by the user
• Enforced as boundaries for the server

If an AI development assistant is connected to your computer (using an IDE), you probably want it to access your current project folder. You do not want it scanning your entire home directory. The client exposes /home/user/projects/my-app and that becomes the root for the server. Now the server knows: “I am allowed to operate inside this directory. Anything outside is off limits.”

Here’s what actually happens.

Step 1: The IDE runs on your machine, it has access to your files and folders. You install an AI assistant plugin that connects to a remote MCP server. The server is running somewhere else (maybe in the cloud) and it has no inherent access to your local filesystem.

Step 2: The client exposes roots and tells the server: “You are allowed to operate inside this folder.”

Step 3: The server cannot read files directly - instead, it sends protocol requests like: “Please read this resource.” or “Please apply this change.” ..etc

Step 4: The client performs the actual file operation but first checks:

• Is this path inside an allowed root?
• Does the user have permission?