{"slug": "vaultsort-ai-connections-safe-mcp-file-access", "title": "VaultSort AI Connections: Safe MCP File Access", "summary": "VaultSort released AI Connections, an MCP server for Mac that gives AI apps including Claude Desktop, Claude Code and Cursor access only to folders a user explicitly selects, with file contents unreadable by default. Before an AI app sees a file, VaultSort replaces passwords, keys and tokens, payment card numbers, IBANs and US Social Security numbers with labelled placeholders, and it requires user approval before large reorganizations or anything sent to the Trash, never permanently deletes or overwrites a file, and allows the whole plan to be undone from Recent Activity. VaultSort positions the product against the reference Filesystem server, whose write_file tool overwrites existing files and which offers no undo or approval step.", "body_md": "**Short answer:** AI Connections is VaultSort's MCP server for your files. It lets AI apps such as Claude Desktop, Claude Code and Cursor work with the folders you choose, and only those. By default they can find files but not read them. Where you allow reading, passwords, keys and card numbers are replaced before the AI sees them. When an AI app wants to reorganize, VaultSort checks the plan, asks you before large changes or anything going to the Trash, never deletes a file permanently or replaces one, and lets you undo the whole plan from **Recent Activity**. It's available on Mac.\n\nThis post explains why file access is the risky part of MCP, how to set up AI Connections, and exactly what a connected AI app can and can't do.\n\n## What MCP is, and why file access is the risky part\n\nThe **Model Context Protocol (MCP)** is the open standard AI apps use to connect to tools and data. An *MCP server* offers a set of tools; an AI app such as Claude Desktop, Claude Code or Cursor calls them. A filesystem MCP server is how an AI app gets at the files on your computer.\n\nThe common starting point is the [reference Filesystem server](https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem). You list the folders it may use, and it gives the AI tools to read, write, edit and move files in them. Its `write_file` tool overwrites existing files, and the server itself has no undo and no approval step. For a developer in a Git repository, that's reasonable: Git is the undo. For your Documents folder, it's a lot of trust.\n\nTwo more things make file access harder than it looks:\n\n- **What the AI reads, the AI provider sees.** A file read into a chat goes to the AI app and its model, passwords and account numbers included.\n- **Files can carry instructions.** A document or web page can contain text written to steer an AI that reads it, known as*prompt injection* . A server that can rewrite anything is only as safe as the most hostile file the AI reads.\n\nAI Connections was built around those risks.\n\n## How to give Claude Desktop, Claude Code or Cursor access to your files\n\n1. **Open VaultSort on your Mac** and go to**Settings › AI Connections** .\n2. **Make a connection.** Each connection has its own name, folders and settings, and it can see nothing until you give it a folder.\n3. **Give it folders.** Choose only the ones the AI app needs. Turn on**Contents** for a folder only if the AI app should read what's inside its files.\n4. **Add it to your AI app.** Click**Set up Claude Desktop** or**Set up Cursor** , and VaultSort adds itself to that app, keeping a backup of the app's settings file. For**Claude Code** , copy the command VaultSort shows and run it in Terminal.\n\nThat's all. Each connection's key is kept in your Mac's Keychain, never in the AI app's settings files, so another program reading those files doesn't get access. If VaultSort isn't running when the AI app needs it, it opens in the background. You can take folders back or remove a connection at any time.\n\n## What a connected AI app can see\n\n- **Only the folders you give it.** It can never reach your Library, system folders, the Trash, other users' files or your[Vault](https://www.vaultsort.com/vault) . You can't give it your whole startup disk or the Users folder, even by accident.\n- **Names first.** It can list your folders and search them by name, type, date and size.\n- **Contents only where you say.** Reading inside files needs**Contents** , which is off by default for every folder. Where it's on, the AI app can read text, code, CSV, JSON, HTML, PDF, Word, Excel and PowerPoint files.\n- **Sensitive details replaced.** Before the AI app sees a file, VaultSort replaces passwords, keys and tokens, payment card numbers, IBANs and US Social Security numbers with labelled placeholders. You can turn on**Show sensitive details** for a connection; when you do, each read that contained them is listed under that connection.\n- **Secret files never read.** Files that are themselves secrets, such as private keys,`.env` files, credential files and password-manager exports, are never read, whatever the settings.\n\nDetection can miss things, and the AI app is told so. Keep Contents off for folders full of material you'd never paste into a chat. (If you need to share a document with sensitive passages removed for good, see [how to redact a PDF properly](https://www.vaultsort.com/blog/how-to-redact-a-pdf-properly).)\n\n## What it can change, and how you undo it\n\nAn AI app can propose a **plan**: move, rename or copy files, create folders, and move items to the Trash. Then:\n\n1. **VaultSort checks every step,** and makes exactly the plan it checked. If a file changed after the plan was checked, the plan is refused rather than guessed at.\n2. **Nothing is deleted permanently and nothing is replaced.** A plan can't erase a file or put one file in place of another.\n3. **You approve the big ones.** VaultSort asks you before applying a plan of more than 50 changes, or any plan that moves items to the Trash.**Don't Allow** is the default, and a question left unanswered counts as no.\n4. **Every plan can be undone.** Each applied plan appears in**Recent Activity** as \"AI connection\" followed by the connection's name, and you can undo it from there. Clearing your history keeps these entries.\n\nPlans also work on USB drives and SD cards formatted as exFAT or FAT32.\n\nIf a folder is protected by **[Safety Net](https://www.vaultsort.com/blog/ai-deleted-my-files-safety-net-mac)**, VaultSort saves a restore point before a connection first changes it. A connected AI app can also save its own restore point before risky work (kept for 3 days) and ask you to restore one; restoring is always your decision.\n\n## Duplicates, Space Saver and Scheduled Jobs, from your AI app\n\nAI Connections reach three more parts of VaultSort, with the same rule: the AI app can look and ask, and you decide.\n\n- **Duplicates.** A connected AI app can look for duplicate files, but only across folders where**Contents** is on, because comparing files means reading them. The search is read-only and changes nothing.\n- **[Space Saver](https://www.vaultsort.com/blog/cleanmymac-alternative-space-saver).** A connected AI app can see how much Space Saver could free in its safe cache categories. It sees sizes only, never file locations. It can ask you to clean them, and nothing is cleaned until you click**Clean** in VaultSort.\n- **Scheduled Jobs.** A connected AI app can list your[scheduled jobs](https://www.vaultsort.com/blog/hazel-alternative-mac-file-automation) and their history, turn a job off, and do a dry run of a scheduled job or a saved Advanced Organize job, which shows what it would do without changing anything. It can*ask* to turn a job on, delete a job, make a new job or change one it made, and each request waits for your approval in VaultSort. It can also ask to run a job now. VaultSort asks you every time, and running a job this way needs Premium.\n\nJobs made by an AI app only move and rename files, so every run can be undone. They never use the Trash or replace files, they look only at files directly inside their folders, and they can't use a folder another job already uses. In Scheduled Jobs they're marked **Made by** with the connection's name, and \"edited by you\" is added once you change them. An AI app is never told the names of folders outside the ones you gave it.\n\n## What it won't do\n\n- **Anything outside VaultSort's tools.** A connected AI app is told what it can and can't do through VaultSort. Secure delete is never available to an AI app. Ask it to securely delete files and it will tell you to do that in VaultSort yourself.\n- **Fence off the AI app's own tools.** Claude Code and Cursor can also edit files and run terminal commands on their own, outside VaultSort. AI Connections makes the VaultSort route safe; it doesn't limit the others. For that, protect your important folders with**[VaultSort Safety Net](https://www.vaultsort.com/blog/ai-deleted-my-files-safety-net-mac)** , which keeps a history an agent can't delete and restores it in one click.\n- **Run on Windows, yet.** AI Connections are Mac only for now.\n\n## AI Connections vs the reference Filesystem server\n\nThe reference server is a good tool for what it's built for: letting a coding assistant edit a project. AI Connections is built for personal files. Here's how they differ, based on the reference server's own documentation:\n\n|  | Reference Filesystem server | VaultSort AI Connections | \n|---|---|---|\n| Choosing folders | Folder list in the AI app's configuration | Per-connection folder grants in VaultSort | \n| Reading file contents | Any file in an allowed folder | Off by default, turned on per folder | \n| Passwords, keys, card numbers | Passed through as written | Replaced with labelled placeholders | \n| Overwriting existing files | `write_file` overwrites | Never replaces a file | \n| Deleting | No delete tool; a move removes the original | Trash only, with your approval; never permanent | \n| Large changes | No approval step in the server | You approve plans of more than 50 changes | \n| Undo | None in the server | Every plan, from Recent Activity | \n| Platforms | Any system that runs Node.js | Mac | \n\nSome AI apps ask your permission before each tool call. That's the AI app's safeguard, and it applies to either server. The rows above are about what the server itself allows.\n\n## Let AI help, and keep a way back\n\nAI Connections and Safety Net are two halves of one idea. AI Connections gives an AI app a safe way to work on your files: chosen folders, checked plans, your approval, and undo. [Safety Net](https://www.vaultsort.com/blog/ai-deleted-my-files-safety-net-mac) covers whatever happens outside that path, whichever app or agent does it. Together, you can say yes to AI help without betting your files on it.\n\nIf you'd rather keep AI on your own Mac entirely, VaultSort's built-in AI features can also run [on-device with Apple Intelligence or Ollama](https://www.vaultsort.com/blog/private-ai-file-organization-apple-intelligence-ollama).\n\n## Frequently asked questions\n\n### Can Claude Desktop access my files?\n\nThrough VaultSort, only the folders you give the connection, and inside files only where you've turned on Contents. It can't reach your Library, system folders, the Trash, other users' files or your Vault through VaultSort.\n\n### Is MCP safe?\n\nMCP is a protocol, so safety depends on the server and what it lets an AI do. For file access, look for a narrow scope, reading off by default, secrets kept out, approval for large or destructive changes, no permanent deletion, and an undo. AI Connections does all six.\n\n### Does Claude Code need a filesystem MCP server?\n\nNot to edit the project you start it in: it has its own file tools for that. AI Connections is useful when you want Claude Code to work with your personal folders through checked plans with approval and undo, or to use Space Saver and Scheduled Jobs.\n\n### Does it work with Cursor?\n\nYes. Click **Set up Cursor** in **Settings › AI Connections**, and VaultSort adds itself to Cursor's settings and keeps a backup of the original.\n\n### Can an AI app delete my files through VaultSort?\n\nNot permanently. It can propose moving items to the Trash, and VaultSort asks you first. Every applied plan can be undone from Recent Activity.\n\n### Are my files sent to the AI?\n\nOnly what the AI app reads. Searching shares names, types, dates and sizes. File contents are shared only from folders where Contents is on, with sensitive details replaced unless you turn that off. Whatever the AI app reads goes to that app and its model provider, as with anything else you share in a chat.\n\n### Is AI Connections free?\n\nSearching, reading, previewing and undoing are always free. Applying plans is free for 5 plans and then needs Premium. Making or changing scheduled jobs from an AI app, and running one on request, needs Premium, and without Premium each Space Saver clean counts as one of Space Saver's 3 free cleans.\n\n### Does AI Connections work on Windows?\n\nNot yet. It's Mac only for now.", "url": "https://wpnews.pro/news/vaultsort-ai-connections-safe-mcp-file-access", "canonical_source": "https://www.vaultsort.com/blog/safe-mcp-file-access-ai-connections", "published_at": "2026-10-19 00:00:00+00:00", "updated_at": "2026-10-19 16:45:44.490196+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "ai-safety"], "entities": ["VaultSort", "AI Connections", "Model Context Protocol", "Claude Desktop", "Claude Code", "Cursor", "Filesystem server"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/vaultsort-ai-connections-safe-mcp-file-access", "markdown": "https://wpnews.pro/news/vaultsort-ai-connections-safe-mcp-file-access.md", "text": "https://wpnews.pro/news/vaultsort-ai-connections-safe-mcp-file-access.txt", "jsonld": "https://wpnews.pro/news/vaultsort-ai-connections-safe-mcp-file-access.jsonld"}}