What is an MCP Roots?

A general-purpose MCP server, such as a filesystem tool or a code-analysis tool, doesn't inherently know what the user considers in scope for the current session. Roots solve this by having the client declare, at connection time, a list of root URIs (typically local directory paths) that represent the boundaries of the current project or workspace. The server is expected to confine its file operations to those roots rather than roaming the entire filesystem. This is a client-enforced convention more than a hard security sandbox: a well-behaved server respects the roots it's given, but the actual enforcement of staying inside a directory still depends on the host's own permission model and, ideally, OS-level sandboxing underneath. Roots exist primarily to communicate intent and reduce accidental scope creep, such as a code-editing tool inadvertently reading files from an unrelated project on the same machine. Hosts can also update the root list dynamically as the user switches projects or opens additional folders, and well-implemented servers listen for those change notifications and adjust their working scope accordingly rather than caching the original root list for the whole session.