Give AI a door to your files, not the keys to your Mac.

AI Connections is VaultSort’s MCP server for your files. It lets AI apps such as Claude Desktop, Claude Code and Cursor work with the folders you choose, and only those. They can find files by name, type, date and size; read inside them only where you turn on Contents; and change them only through plans VaultSort checks, that you approve when they’re large, and that you can undo.

The Model Context Protocol (MCP) is the open standard AI apps use to connect to tools and data. An MCP server offers a set of tools, and an AI app such as Claude Desktop, Claude Code or Cursor calls them. A filesystem MCP server is how an AI app gets at the files on your computer.

Through VaultSort, only the folders you give the connection, and inside files only where you’ve turned on Contents. It can’t reach your Library, system folders, the Trash, other users’ files or your Vault through VaultSort, and you can’t give it your whole startup disk or the Users folder.

MCP is a protocol, so safety depends on the server and what it lets an AI do. For file access, look for a narrow scope, reading off by default, secrets kept out, approval for large or destructive changes, no permanent deletion, and an undo. AI Connections does all six.

Open VaultSort on your Mac and go to Settings › AI Connections. Make a connection and give it folders. Then click Set up Claude Desktop or Set up Cursor, and VaultSort adds itself to that app, keeping a backup of the app’s settings file. For Claude Code, copy the command VaultSort shows and run it in Terminal.

Not permanently. It can propose moving items to the Trash, and VaultSort asks you first. Don’t Allow is the default, and a question left unanswered counts as no. Every applied plan can be undone from Recent Activity. Secure delete is never available to an AI app.

Only what the AI app reads. Searching shares names, types, dates and sizes. File contents are shared only from folders where Contents is on, with passwords, keys and tokens, card numbers, IBANs and US Social Security numbers replaced by labelled placeholders unless you turn on Show sensitive details. Detection can miss things, and the AI app is told so. Whatever the AI app reads goes to that app and its model provider, as with anything else you share in a chat.

In folders where Contents is on: text, code, CSV, JSON, HTML, PDF, Word, Excel and PowerPoint files. Files that are themselves secrets, such as private keys, .env files, credential files and password-manager exports, are never read, whatever the settings.

The reference server lets an AI read any file in its allowed folders and overwrite files with write_file, and the server itself has no approval step and no undo. That suits a coding assistant in a Git repository. AI Connections is built for personal files: reading is off by default, sensitive details are replaced, nothing is ever replaced or permanently deleted, you approve plans of more than 50 changes or anything going to the Trash, and every plan can be undone.

Not to edit the project you start it in: it has its own file tools for that. AI Connections is useful when you want Claude Code to work with your personal folders through checked plans with approval and undo, or to use Space Saver and Scheduled Jobs.

No. Claude Code and Cursor can also edit files and run terminal commands on their own, outside VaultSort. AI Connections makes the VaultSort route safe; it doesn’t limit the others. For that, protect important folders with Safety Net, which keeps a history an agent can’t delete and restores a folder in one click.

Searching, reading, previewing, finding duplicates and undoing are free. Applying plans is free for 5 plans, then needs Premium, as do making, changing or running a scheduled job from an AI app.

Not yet. AI Connections is Mac only for now.