How to Connect SFTP to Claude: Safe Access to Your Server Files

To connect SFTP to Claude or Cursor, you give it an FTP MCP server: tools to browse and read the files on a hosting account or file server, such as error logs, config files and recently changed code. GetMCP’s File Server connector turns any SFTP, FTPS or FTP login into one, with 13 tools. It starts read-only, keeps every path inside a folder you choose, and leaves uploads, edits and deletes off until you turn them on.

It is for people who still open an FTP client to answer a simple question: site owners chasing a white screen, agencies looking after many client sites, developers checking what changed on staging, and anyone cleaning up after a hacked site. This guide covers setup, the tools, the safety rules and good uses for each.

What is an FTP MCP server?

An MCP server publishes tools that Claude, ChatGPT, Cursor and other clients can call. An FTP MCP server’s tools work on a remote file system: list a folder, read a file, find files by name or date, and, if you allow it, write or edit them. You ask “why is the site showing a 500 error?” and the model reads the last lines of the error log for you.

In GetMCP it is the File Server (SFTP / FTP) template, added in version 1.7.0. The connection lives in the server’s File server settings. Passwords and SSH keys are stored encrypted on your install, and the API only ever reports whether one is set. SFTP runs through a pure-PHP library, so the host does not need the ssh2 extension.

How to connect SFTP to Claude: setup

1. Install the template. Open Templates and install File Server (SFTP / FTP). GetMCP creates the server and opens the File server section of its Settings tab.
2. Choose your host. The host list sets the protocol, port and login method, and its note says what the host name looks like and where your host shows the login. Presets cover cPanel hosting, Hostinger, Namecheap shared hosting, GoDaddy (cPanel), SiteGround, WP Engine, Kinsta, Cloudways, Pantheon, AWS Transfer Family, Azure Blob Storage (SFTP) and Synology NAS. It never fills in a password.
3. Pick the protocol. SFTP (over SSH), which is recommended; FTPS with explicit TLS; FTPS with implicit TLS on port 990; or FTP, which is unencrypted.
4. Enter the login. Host, Port and Username, then a password, or on SFTP an SSH private key with an optional Key passphrase.
5. Fence it in. Set Root folder (optional), for example /public_html; tools cannot reach above it. Set File size cap (MB) (1 to 20, default 5) and Timeout (s) (default 30).
6. Test connection. The test saves your changes, signs in and lists the root folder. On SFTP it also shows the server’s host key, which you can pin with one click.
7. Connect a client. Use Quick Connect for Claude or Cursor, or add the endpoint to any MCP client.

The thirteen tools

Six tools only read and are active on install. Seven change files and install disabled, and even when enabled they are refused while Read-only connection is ticked, which it is by default.

Tool	What it does	On install
list_directory	Files and folders with type, size, modified time and permissions. Paged, optionally recursive.	On
get_file_info	Whether a path exists and what it is, with size, time, permissions and a guessed MIME type.	On
read_file	A text file, or only its first or last lines with head_lines or tail_lines. 100,000 bytes by default, up to 1,000,000.	On
find_files	Search by name pattern (*.php), type, size or modified_within_hours, sorted by name, modified time or size.	On
download_file	Any file, binary included, base64-encoded, within the size cap.	On
checksum_file	SHA-256, SHA-1 or MD5 of a file up to 100 MB, without sending its content.	On
write_file	Create a file, or replace one only when overwrite is true.	Off
edit_file	Replace exact pieces of text, up to 50 edits per call, with a dry_run preview.	Off
append_file	Add text to the end of a file, creating it if missing.	Off
create_directory	Create a folder and any missing parents.	Off
move_path	Move or rename a file or folder.	Off
delete_path	Delete a file, or a folder and its contents (up to 1,000 entries) when recursive is true.	Off
set_permissions	chmod with an octal mode such as 644 or 755, on servers that allow it.	Off

Safety rules on your server

• Two locks before a write. The connection is read-only and the write tools are disabled. A write on a read-only connection is refused before GetMCP connects.
• Kept inside one folder. Paths are resolved against the root folder, .. cannot climb out, and any path through a symbolic link is refused, because a link can lead outside the root.
• Careful edits. Each edit’s old_text must appear exactly once. Nothing is saved unless every edit matches.
• No half-written files. Writes and edits upload to a temporary name and then move into place, so a dropped connection never leaves a broken file. A replaced file keeps its permissions.
• No dangerous permissions. set_permissions refuses world-writable modes such as 777 and 666, and setuid, setgid and sticky bits.
• The server you expect. FTPS verifies the TLS certificate unless you turn that off. On SFTP, a pinned Host key fingerprint (as ssh-keygen -lf prints it) makes GetMCP refuse to log in if the key changes.
• Passive FTP only. The address in the server’s passive-mode reply is ignored, so a hostile server cannot point your install at its own internal network.

Use cases

Once you connect SFTP to Claude, these are the jobs it handles well.

Diagnose a 500 error from the error log

Acme’s shop shows a server error after a plugin update. Ask Claude what broke. It finds the error log and reads the last 50 lines, then names the file and line at fault.

find_files ("error_log*") → read_file (tail_lines: 50) → diagnosis

Investigate a hacked site with the read tools

List the PHP files that changed in the last week, read the ones nobody uploaded, and look for code hidden behind eval or base64_decode. Take a backup, then enable edit_file and preview each removal with dry_run before saving. GetMCP does not detect malware itself: the AI suggests and you approve each change.

// find_files: which PHP files changed this week?
{ "path": "/public_html", "pattern": "*.php", "modified_within_hours": 168 }

// edit_file: remove one injected line, preview first
{
  "path": "/public_html/wp-config.php",
  "edits": [{ "old_text": "@eval(base64_decode($_POST['x']));", "new_text": "" }],
  "dry_run": true
}

Agency site checks across clients

An agency creates one read-only FTP MCP server per client site and publishes them through the MCP Gateway. A team member asks for the size of each site’s uploads folder, or which sites have a wp-config.php with loose permissions.

Verify a deployment

After a release, a developer asks Cursor to compare checksums of the deployed files with the build. checksum_file returns hashes without transferring the files.

list_directory → checksum_file (sha256) × n → mismatches listed

Small config changes with a preview

Northwind’s developer needs a debug flag switched off on staging. With the read-only connection off and only edit_file enabled, the model reads the file, previews the one-line change with dry_run, and saves after approval.

Read reports dropped on a NAS

An office exports nightly CSV reports to a Synology NAS on the LAN. An install on the same network can reach it, and the assistant reads the latest file and summarises it each morning.

Tips and gotchas

• Keep the write tools off while the AI reads untrusted files. A planted file can contain text written to mislead a model. Investigate first, then enable only the write tool you need.
• Prefer SFTP or FTPS. Plain FTP sends the password and files unencrypted. Use it only when the server offers nothing else.
• Pin the host key. After the first successful test on SFTP, pin the fingerprint it reports.
• Binary files need download_file. read_file refuses images, archives and PDFs and points to download_file.
• Searches are bounded. find_files stops after a set depth and number of folders and says truncated: true. Narrow the path to search deeper.
• Private addresses are allowed by default. A NAS or staging box on your LAN works. On hosted or shared installs, switch off Settings → Security → Private Network Access. Cloud metadata addresses are always refused.
• chmod depends on the server. Windows servers usually do not support set_permissions.

Related features

• MCP server templates: where the File Server, Database and Mailbox connectors are installed.
• The MCP Gateway: publish several file servers at one endpoint.
• Analytics and call logs: a record of every file the AI read or changed.

FAQ

Does an FTP MCP server give the AI my FTP password?

No. Passwords and SSH keys are stored encrypted on your install and used only by your server to open the connection. The client sees tools, and the API never returns a stored password or key.

Can I log in with an SSH key?

Yes, on SFTP. Choose SSH private key as the login method, paste the key, and add the passphrase if the key is encrypted.

Can the AI delete my whole site?

Not by default. The connection is read-only and delete_path installs disabled. Even when enabled, it stays inside the root folder, never deletes the root itself, and removes at most 1,000 entries per call.

Which hosts are supported?

Any server that speaks SFTP, FTPS or FTP. Twelve presets cover common hosts such as cPanel, Hostinger, SiteGround, WP Engine and Kinsta; for anything else, leave the preset empty and enter the host and port yourself.

Let your AI read the logs for you, and change nothing until you say so. See the File Server connector page, or compare plans on pricing.