Summary

Please add full support for the MCP “Roots” capability in the Goose client, as defined in the official Model Context Protocol documentation:

👉 https://modelcontextprotocol.io/docs/learn/client-concepts#roots

At the moment, Goose can launch @modelcontextprotocol/server-filesystem, but it does not advertise or manage MCP roots. As a result, when the filesystem server is started without static directory arguments, it receives no allowed directories, and all file operations are denied.

This prevents the use of dynamic roots, which are a core concept of MCP.

Problem Statement

According to the MCP specification:

• Roots are owned and controlled by the client, not the server.
• Servers (like server-filesystem) rely on the client to send roots dynamically.
• If no roots are provided, filesystem access must be denied for security reasons.

In Goose today:

• The filesystem server is launched successfully.
• The server exposes the Roots capability.
• Goose never sends any roots, resulting in:
  • list_allowed_directories returning an empty array
  • write_file / read_file failing with
    Access denied - path outside allowed directories

This makes the documented “dynamic roots” mode unusable.

Expected Behavior

1. Roots Discovery

Goose should determine one or more workspace/project roots, for example:

• The currently opened folder
• The active workspace
• User-configured project directories

2. Roots Advertisement (MCP)

Goose should notify MCP servers of root changes using the Roots protocol, e.g.:

{
  "jsonrpc": "2.0",
  "method": "roots/list_changed",
  "params": {
    "added": [
      {
        "uri": "file:///home/user/projects/my-project",
        "name": "my-project"
      }
    ],
    "removed": []
  }
}

This must happen:

• On initial connection
• When the active project/workspace changes<

3. Dynamic Updates

When the user switches projects, Goose should update roots accordingly.
Filesystem servers should immediately reflect the new allowed directories.

Acceptance Criteria

Why This Matters

Implementing MCP Roots support in Goose would:

• Enable secure, dynamic filesystem access
• Remove the need for static CLI arguments when starting servers<
• Align Goose with the official MCP specification
• Improve developer experience when working across multiple projects
• Make Goose interoperable with other MCP-compliant tools

Example Scenario

Current behavior

npx -y @modelcontextprotocol/server-filesystem

• No roots provided by Goose

• Allowed directories list is empty

• write_file → ❌ Access denied

Expected behavior with Roots

• Goose sends workspace root(s)

• Filesystem server whitelists those paths

• write_file / read_file → ✅ Works as expected

References

• MCP Roots specification
  https://modelcontextprotocol.io/docs/learn/client-concepts#roots

• server-filesystem package
  https://www.npmjs.com/package/@modelcontextprotocol/server-filesystem