VaultSort AI Connections: Safe MCP File Access

Short answer: AI Connections is VaultSort's MCP server for your files. It lets AI apps such as Claude Desktop, Claude Code and Cursor work with the folders you choose, and only those. By default they can find files but not read them. Where you allow reading, passwords, keys and card numbers are replaced before the AI sees them. When an AI app wants to reorganize, VaultSort checks the plan, asks you before large changes or anything going to the Trash, never deletes a file permanently or replaces one, and lets you undo the whole plan from Recent Activity. It's available on Mac.

This post explains why file access is the risky part of MCP, how to set up AI Connections, and exactly what a connected AI app can and can't do.

What MCP is, and why file access is the risky part #

The Model Context Protocol (MCP) is the open standard AI apps use to connect to tools and data. An MCP server offers a set of tools; an AI app such as Claude Desktop, Claude Code or Cursor calls them. A filesystem MCP server is how an AI app gets at the files on your computer.

The common starting point is the reference Filesystem server. You list the folders it may use, and it gives the AI tools to read, write, edit and move files in them. Its write_file tool overwrites existing files, and the server itself has no undo and no approval step. For a developer in a Git repository, that's reasonable: Git is the undo. For your Documents folder, it's a lot of trust.

Two more things make file access harder than it looks:

• What the AI reads, the AI provider sees. A file read into a chat goes to the AI app and its model, passwords and account numbers included.
• Files can carry instructions. A document or web page can contain text written to steer an AI that reads it, known asprompt injection . A server that can rewrite anything is only as safe as the most hostile file the AI reads.

AI Connections was built around those risks.

How to give Claude Desktop, Claude Code or Cursor access to your files #

1. Open VaultSort on your Mac and go toSettings › AI Connections .
2. Make a connection. Each connection has its own name, folders and settings, and it can see nothing until you give it a folder.
3. Give it folders. Choose only the ones the AI app needs. Turn onContents for a folder only if the AI app should read what's inside its files.
4. Add it to your AI app. ClickSet up Claude Desktop orSet up Cursor , and VaultSort adds itself to that app, keeping a backup of the app's settings file. ForClaude Code , copy the command VaultSort shows and run it in Terminal.

That's all. Each connection's key is kept in your Mac's Keychain, never in the AI app's settings files, so another program reading those files doesn't get access. If VaultSort isn't running when the AI app needs it, it opens in the background. You can take folders back or remove a connection at any time.

What a connected AI app can see #

• Only the folders you give it. It can never reach your Library, system folders, the Trash, other users' files or yourVault . You can't give it your whole startup disk or the Users folder, even by accident.
• Names first. It can list your folders and search them by name, type, date and size.
• Contents only where you say. Reading inside files needsContents , which is off by default for every folder. Where it's on, the AI app can read text, code, CSV, JSON, HTML, PDF, Word, Excel and PowerPoint files.
• Sensitive details replaced. Before the AI app sees a file, VaultSort replaces passwords, keys and tokens, payment card numbers, IBANs and US Social Security numbers with labelled placeholders. You can turn onShow sensitive details for a connection; when you do, each read that contained them is listed under that connection.
• Secret files never read. Files that are themselves secrets, such as private keys,.env files, credential files and password-manager exports, are never read, whatever the settings.

Detection can miss things, and the AI app is told so. Keep Contents off for folders full of material you'd never paste into a chat. (If you need to share a document with sensitive passages removed for good, see how to redact a PDF properly.)

What it can change, and how you undo it #

An AI app can propose a plan: move, rename or copy files, create folders, and move items to the Trash. Then:

1. VaultSort checks every step, and makes exactly the plan it checked. If a file changed after the plan was checked, the plan is refused rather than guessed at.
2. Nothing is deleted permanently and nothing is replaced. A plan can't erase a file or put one file in place of another.
3. You approve the big ones. VaultSort asks you before applying a plan of more than 50 changes, or any plan that moves items to the Trash.Don't Allow is the default, and a question left unanswered counts as no.
4. Every plan can be undone. Each applied plan appears inRecent Activity as "AI connection" followed by the connection's name, and you can undo it from there. Clearing your history keeps these entries.

Plans also work on USB drives and SD cards formatted as exFAT or FAT32.

If a folder is protected by Safety Net, VaultSort saves a restore point before a connection first changes it. A connected AI app can also save its own restore point before risky work (kept for 3 days) and ask you to restore one; restoring is always your decision.

Duplicates, Space Saver and Scheduled Jobs, from your AI app #

AI Connections reach three more parts of VaultSort, with the same rule: the AI app can look and ask, and you decide.

• Duplicates. A connected AI app can look for duplicate files, but only across folders whereContents is on, because comparing files means reading them. The search is read-only and changes nothing.
• Space Saver. A connected AI app can see how much Space Saver could free in its safe cache categories. It sees sizes only, never file locations. It can ask you to clean them, and nothing is cleaned until you clickClean in VaultSort.
• Scheduled Jobs. A connected AI app can list yourscheduled jobs and their history, turn a job off, and do a dry run of a scheduled job or a saved Advanced Organize job, which shows what it would do without changing anything. It canask to turn a job on, delete a job, make a new job or change one it made, and each request waits for your approval in VaultSort. It can also ask to run a job now. VaultSort asks you every time, and running a job this way needs Premium.

Jobs made by an AI app only move and rename files, so every run can be undone. They never use the Trash or replace files, they look only at files directly inside their folders, and they can't use a folder another job already uses. In Scheduled Jobs they're marked Made by with the connection's name, and "edited by you" is added once you change them. An AI app is never told the names of folders outside the ones you gave it.

What it won't do #

• Anything outside VaultSort's tools. A connected AI app is told what it can and can't do through VaultSort. Secure delete is never available to an AI app. Ask it to securely delete files and it will tell you to do that in VaultSort yourself.
• Fence off the AI app's own tools. Claude Code and Cursor can also edit files and run terminal commands on their own, outside VaultSort. AI Connections makes the VaultSort route safe; it doesn't limit the others. For that, protect your important folders with**VaultSort Safety Net** , which keeps a history an agent can't delete and restores it in one click.
• Run on Windows, yet. AI Connections are Mac only for now.

AI Connections vs the reference Filesystem server #

The reference server is a good tool for what it's built for: letting a coding assistant edit a project. AI Connections is built for personal files. Here's how they differ, based on the reference server's own documentation:

Some AI apps ask your permission before each tool call. That's the AI app's safeguard, and it applies to either server. The rows above are about what the server itself allows.

Let AI help, and keep a way back #

AI Connections and Safety Net are two halves of one idea. AI Connections gives an AI app a safe way to work on your files: chosen folders, checked plans, your approval, and undo. Safety Net covers whatever happens outside that path, whichever app or agent does it. Together, you can say yes to AI help without betting your files on it.

If you'd rather keep AI on your own Mac entirely, VaultSort's built-in AI features can also run on-device with Apple Intelligence or Ollama.

Frequently asked questions #

Can Claude Desktop access my files?

Through VaultSort, only the folders you give the connection, and inside files only where you've turned on Contents. It can't reach your Library, system folders, the Trash, other users' files or your Vault through VaultSort.

Is MCP safe?

MCP is a protocol, so safety depends on the server and what it lets an AI do. For file access, look for a narrow scope, reading off by default, secrets kept out, approval for large or destructive changes, no permanent deletion, and an undo. AI Connections does all six.

Does Claude Code need a filesystem MCP server?

Not to edit the project you start it in: it has its own file tools for that. AI Connections is useful when you want Claude Code to work with your personal folders through checked plans with approval and undo, or to use Space Saver and Scheduled Jobs.

Does it work with Cursor?

Yes. Click Set up Cursor in Settings › AI Connections, and VaultSort adds itself to Cursor's settings and keeps a backup of the original.

Can an AI app delete my files through VaultSort?

Not permanently. It can propose moving items to the Trash, and VaultSort asks you first. Every applied plan can be undone from Recent Activity.

Are my files sent to the AI?

Only what the AI app reads. Searching shares names, types, dates and sizes. File contents are shared only from folders where Contents is on, with sensitive details replaced unless you turn that off. Whatever the AI app reads goes to that app and its model provider, as with anything else you share in a chat.

Is AI Connections free?

Searching, reading, previewing and undoing are always free. Applying plans is free for 5 plans and then needs Premium. Making or changing scheduled jobs from an AI app, and running one on request, needs Premium, and without Premium each Space Saver clean counts as one of Space Saver's 3 free cleans.

Does AI Connections work on Windows?

Not yet. It's Mac only for now.