agentleFS

Agent permissions for the files your team shares

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

  • List Org Folders: Orientation call, worth making once at the start of any session about this organization: lists the folders you can reach and what is in them. Pass a folder to see its shape — how man
  • Search Org Knowledge: Search what this organization has written down — policies, runbooks, decisions, postmortems, onboarding docs, past projects. ACL-filtered to you: content you lack a role for is n
  • List Org Docs: List the documents you are authorized to read in a folder. Use this to browse; use search_org_knowledge to answer a question. Filtering by `label` matches labels INHERITED from a folder

What data it sees

Do you need an account

No: the server works without sign-in

Agent permissions for the files your team shares

How to connect

How to connect agentleFS to Claude

The server address to paste into Claude settings:

https://agentlefs.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect agentleFS to ChatGPT

The server address to paste into ChatGPT settings:

https://agentlefs.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect agentleFS to Cursor

The server address to paste into Cursor settings:

https://agentlefs.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (24)

Raw names from tools/list. Only developers need these.

list_org_foldersOrientation call, worth making once at the start of any session about this organization: lists the folders you can reach and what is in them. Pass a folder to see its shape — how many files you can read, by type and label, and how many are gated from you. Labels include ones inherited from the folder, so they name what a folder is about, not only what individual documents declare.
search_org_knowledgeSearch what this organization has written down — policies, runbooks, decisions, postmortems, onboarding docs, past projects. ACL-filtered to you: content you lack a role for is never returned. Omit `folder` to search everything you can reach.
list_org_docsList the documents you are authorized to read in a folder. Use this to browse; use search_org_knowledge to answer a question. Filtering by `label` matches labels INHERITED from a folder or directory as well as a document's own, so a folder's label returns everything inside it.
read_org_docOpen one document and read it. Returns a shareable console link alongside the body so you can cite what you used. A path you cannot read returns not-found — identical to a path that does not exist, so this never reveals that a file you are denied exists.
edit_org_docChange part of a document, leaving the rest untouched. Refuses rather than guessing: if the text you are replacing is missing, appears more than once without replace_all, the edit would remove the frontmatter block or leave it unparseable, or the document moved since expected_commit, nothing is written and you are told what is there now. If another writer commits between this call's read and its write, the edit is REFUSED rather than applied on top of theirs — re-read and re-apply. The confirmation carries a console link to the document you changed.
write_org_docPersist something durable — a resolved answer, a runbook, a decision — so the next agent inherits it. Ephemeral chat output is lost. Commits immediately if your grant allows it, and is refused if it does not. The confirmation says whether it CREATED the document or OVERWROTE one, names any directory that did not exist before (check it against what you meant — a typo in folder_path silently mints a new one), and carries a console link you can hand to a person. Set metadata with YAML frontmatter at the top of `content`: `type` (one of: meeting-notes, playbook, spec, brand-asset, web-clip, contract, misc — anything else becomes misc), `title`, `summary`, and `tags` as a list. `tags` is the write-side spelling of what the listing tools call `label`. `status` takes `active` or `inactive` and is not a label: `inactive` retires a document — it stays in the folder and stays openable in the console, but agents stop retrieving it. Omit it unless you mean to retire something.
erase_org_docPERMANENTLY destroy a document or a folder — its content, every past version, its comments and its name. NOTHING brings it back; this is not delete_org_doc, which is recoverable. Use it only for a genuine erasure request (someone asking that their data be removed), and prefer delete_org_doc for ordinary tidying. TWO CALLS, ALWAYS: the first returns exactly what would stop existing plus a confirm_token and destroys NOTHING — show that to the person you are working for, get their answer, then call again with the token. Never confirm on their behalf. Requires OWNER: what you own is erased and what you do not is left and reported, so a folder can come back partly done. The audit record of the erasure survives on purpose.
delete_org_docDelete a document, a directory, or an entire folder. TWO CALLS, ALWAYS: the first returns what would be deleted and a confirm_token, and deletes NOTHING — show that to the person you are working for, get their answer, then call again with the token. Never confirm on their behalf. Requires OWNER on every file this would remove — including files you cannot see — and refuses the whole operation if even one is out of reach, rather than half-emptying anything. `location` names a file (deleted on its own) or a directory (everything beneath it). Pass a bare folder name to delete the WHOLE folder, which also removes its connector sync source and requires confirm_delete_folder. Sharing is NOT withdrawn: reach grants survive a delete, which is what lets undo_delete restore the folder with its sharing intact. History is content-addressed, so this is recoverable.
undo_deleteUndo the last delete at a location — a document, a directory, or a whole folder. Restores exactly what that one delete removed, at the version it had, with its sharing intact. Pass the same `location` that was deleted. Undoing twice is harmless: the second call finds nothing left to restore and says so. A document that was deleted before it ever had content cannot be restored and is reported separately rather than resurrected empty.
create_org_folderMake a folder. Use it to start a project before putting anything in it — content goes in a folder and access is granted on one, so the folder is the unit everything else hangs off. You become its owner, which is what lets you share it.
share_org_folderShare a folder or document with people by email, so they can read or edit it. Someone in this organization gets an ordinary grant; anyone else gets it in their Shared with me, and a stranger is invited to sign up. TWO CALLS: the first returns exactly who would be mailed and at what level plus a confirm_token, and shares nothing. Show that to the user, then call again with the token. This sends real email and changes who can read their content.
connect_org_sourceStep one of connecting a source. Returns a link for the USER to open: authorising happens at GitHub or Google, in their browser, and cannot be done for them — give them the link and wait. When they say they are done, call list_org_sources to see the account that arrived, then add_org_source to point one repository or Drive folder at a folder here. list_org_sources again afterwards tells you whether the first sync actually ran.
list_org_sourcesWhat this organization has connected — GitHub repositories, Google Drive folders — where each one writes, and whether it is actually syncing. Call it after connecting something to confirm it worked, or when content you expected is missing and you want to know whether the source ran and failed or never ran at all. Sync is ONE-WAY, from the source into agentleFS, and it repeats: the source is polled and the destination folder is brought up to date. Documents you write here are not pushed back to the repository, and a connector-owned path refuses direct edits rather than having them silently overwritten on the next run.
add_org_sourceAfter an account is connected, point one repository or Drive folder at a folder here, so its documents sync in. The destination is a folder you can write to — create_org_folder first if it does not exist. Call list_org_sources afterwards to confirm it ran. Sync is ONE-WAY, from the source into agentleFS, and it repeats: the source is polled and the destination folder is brought up to date. Documents you write here are not pushed back to the repository, and a connector-owned path refuses direct edits rather than having them silently overwritten on the next run.
who_can_readWho currently reaches a folder or document — people and groups inside this organization, direct and inherited, AND people outside it who hold a share. Call it after sharing to confirm the grant landed, or before sharing to see who is already there. Names people, never their content. Answers only for a scope you reach yourself; one you do not answers not-found, identical to a scope that does not exist.
revoke_org_shareTake back a share given to somebody outside this organization. Names go in as the email address it was shared with — who_can_read lists them. Grants held by members of this organization are not touched: those can be inherited from a parent folder, so they are changed in the console where you can see where the grant actually lives.
add_org_agentAdd an agent to this organization: creates it, gives it one role on a folder, a document or the whole organization, and returns its token. You can only give what you own — a scope you own or one below it. Agents you add may add agents of their own, bounded the same way. Names need not be unique; each agent gets its own id. TWO CALLS: the first previews and creates nothing; call again with its confirm_token to create. The token is shown once, in that answer. Retire the agent with revoke_org_agent when its work is done.
revoke_org_agentRetire (revoke) an agent you added, and every agent it added in turn: their access and tokens are revoked, and this cannot be undone. Call with no agent to list the agents you added that are still live. TWO CALLS to retire: the first previews who would be retired and returns a confirm_token.
list_org_peopleWho is in this organization and what groups exist, with each group's membership. Use it before granting access, so 'the team' resolves to actual people instead of a guess. Pass a group to see just its members. Names people and groups only — never anybody's content.
create_org_share_linkMake a link that gives access to a folder or document. Two audiences: omit `emails` and anyone who opens it can claim it, or pass `emails` and only those addresses can — safe to forward either way, but only the second is safe to post. Use it when you have been asked to share something and have no addresses, or have them and would rather send one link than mail everybody. Sends nothing by itself; access happens when a person opens it and signs in.
claim_share_linkAccept a agentleFS share link that was given to you, so the folder or document it names becomes readable. Pass the whole URL or just its token. Claiming twice is harmless — it reports the same outcome rather than granting anything twice.
read_org_boardRead the board on a folder or document: context people and agents left for whoever reads next, open requests and who they are for, inconsistencies flagged between two documents, and who is working on what. A document's board includes what it inherits from the folders above it; a folder's includes what is open below it and who has been editing nearby. Pass `post` to read one thread in full (a reply's id works too). Pass no location, node or post to see every request waiting on you, everywhere you can read — or requests="asked_by_me" for the ones YOU asked that are still open. A board is paged: the footer says how many there are and the offset for the next page. read_org_doc, list_org_docs and the write tools already show a short board trailer — call this when you want the whole of it.
post_org_boardAdd to the board on a folder or document, for whoever reads it next. kind=context leaves a note (why something is shaped the way it is, what not to change). kind=request asks for something, optionally naming people or agents in `to` (an email, or the exact name list_org_people prints) — naming someone shares NOTHING with them: they see it only if they can already read this. kind=inconsistency flags that this disagrees with another folder or document, named in `about`. kind=working says you are in the middle of something here so nobody duplicates it; it expires on its own (72h unless expires_in_hours). To reply to a post, pass `reply_to` with its id (a reply's id works: it joins that thread); add close=closed with your reason as the body to close it, or close=refused to decline a request addressed to you. Posts are attributed to you and marked as coming from an agent. Board posts are never search-ranked; they show beside what readers open.
list_my_recent_workWhat YOU have been working on lately — documents you edited or opened, and which folders moved. Worth one call at the start of a session once you know what the user wants, to learn where in the store to look before you search. Returns observations only, never a claim about your role, and states what it is based on so you can tell a real picture from a thin one. A hint for aiming search_org_knowledge — not a substitute for it.