Coding Tools MCP is a model-neutral coding runtime exposed as an MCP (Model Context Protocol) server. It gives any MCP client the operations a coding agent needs (reading and searching files, applying multi-file patches, running commands, keeping interactive processes alive, and inspecting git history) inside one bounded workspace. It is not an agent framework: it is the tool layer that a chat client such as Claude Desktop, a coding harness such as Claude Code, Codex, or Cline, or an agent you build yourself connects to.
Safety is built around a single workspace root per server. Absolute paths, parent-directory traversal, and symlink escapes are rejected, and command execution runs under one of three permission modes. On Linux, Landlock adds kernel-level filesystem confinement, and a Docker image is provided for untrusted code. Commands run with a workspace-bound working directory, a scrubbed environment, timeouts, and output caps. Results are summarized, paginated, and capped to save context, and root AGENTS.md or CLAUDE.md files are returned to the client as instructions on connect.
The server speaks both stdio and Streamable HTTP. For remote use it supports bearer tokens and OAuth 2.1 with PKCE, so a client such as claude.ai, ChatGPT, or Grok can reach a workstation through an authenticated tunnel. A bundled Cloudflare Worker control plane can start an ephemeral cloud sandbox with one MCP call, and an optional desktop GUI manages workspace profiles, servers, and tunnels. Anonymous usage telemetry is on by default and can be switched off.
| Mode | Meant for | What it allows |
|---|---|---|
| safe (default) | day-to-day agent work | file tools and vetted commands. Network-looking commands, shell expansion, inline scripts, and destructive commands require explicit permission |
| trusted | local development | opens network, shell expansion, and inline scripts, keeps secret filtering and destructive-command checks |
| dangerous | isolated containers or VMs only | disables command permission gates, workspace path boundaries still apply |
Features
- Files and search: read_file, list_dir, list_files, search_text, and view_image, with build outputs, dependencies, and caches excluded from recursive search
- Atomic patching: apply_patch and apply_changes are staged, baseline-checked, atomic across files, and support rollback
- Interactive processes: exec_command runs REPLs and debuggers under a real PTY, with write_stdin, read_output, and kill_command across turns
- Git inspection: git_status, git_diff, git_log, git_show, and git_blame
- Permission modes: safe, trusted, and dangerous modes gate network access, shell expansion, inline scripts, and destructive commands
- Workspace confinement: one root per server, traversal and symlink escapes rejected, and Landlock filesystem confinement on Linux
- Remote access: bearer tokens and OAuth 2.1 with PKCE for reaching a workstation through an authenticated tunnel
- Sandboxes: a Docker image for untrusted code and a Cloudflare Worker control plane that starts an ephemeral cloud sandbox
- Desktop GUI: per-workspace profiles, server and tunnel controls, credential setup, and health checks, in English and Simplified Chinese
- Context-aware results: summarized, paginated, and capped tool output, with full structured results alongside concise text
