What are MCP roots?

Roots let a client describe the workspace it is working in. Each root has a URI, which the current specification requires to be a file:// URI, and an optional human-readable name. A server asks for them by returning an InputRequiredResult that contains a roots/list request, and the client answers on the retry. A client that supports the feature declares the roots capability. Typical sources are a workspace or project picker, which can be combined with detection from version control or project files, though the spec does not require any particular interface. A user with several repositories could expose each one as a separate root.

The spec is explicit that roots are informational guidance and not an access-control mechanism. The protocol does not force servers to stay inside them. Even so, it asks servers to respect root boundaries and validate paths against the provided roots. Clients must expose only roots with appropriate permissions, validate root URIs to prevent path traversal, and should ask for user consent before sharing them.

Status note: as of the 2026-07-28 revision (checked 2026-10-26), the page marks the roots feature as deprecated. It stays in the specification for at least twelve months from that revision's release. New implementations should not adopt it, and existing ones should switch to passing directories or files through tool parameters, resource URIs or server configuration.