Coding Tools MCP

Coding Tools MCP exposes practical coding operations as a Model Context Protocol server: workspace file reading and search, structured multi-file patches, command execution, interactive process control, git inspection, and local image viewing. It is a tool layer rather than an agent framework, so the connecting client supplies the model and the agent loop.

The server is Python 3.11 or newer and runs over stdio or Streamable HTTP on a loopback address. A thin Node launcher starts it through uv or pipx, and the same JSON configuration block works across MCP clients including Claude Desktop, Claude Code, Codex, Cursor, Cline, VS Code, Windsurf, Gemini CLI, and Cline. Remote use pairs a loopback bind with an authenticated HTTPS tunnel (cloudflared, ngrok, or a Microsoft Dev Tunnel); bearer tokens and OAuth 2.1 with PKCE and RFC 7591 dynamic registration are built in. A Docker image and a Cloudflare Worker control plane provision disposable sandboxes for untrusted code.

The catalog is fixed at 18 tools grouped into files and search (readfile, listdir, listfiles, searchtext, applypatch, viewimage), execution (execcommand, writestdin, readoutput, killcommand, requestpermissions), git (gitstatus, gitdiff, gitlog, gitshow, gitblame), and runtime metadata (serverinfo, checkexecenvironment). applypatch is the only file-mutation primitive: staged, baseline-checked, atomic across files, and rollback-capable.

Permission modes change command policy, not which tools the model sees:

Mode	Intended for	What it allows
safe (default)	day-to-day agent work	file tools and vetted commands; network-looking commands, shell expansion, inline scripts, and destructive commands need explicit permission
trusted	local development	network access, shell expansion, and inline scripts, keeping secret filtering and destructive-command checks
dangerous	isolated containers or VMs	no exec_command permission gates; workspace path boundaries still apply

Features

• One workspace root: absolute paths, .. traversal, and symlink escapes are rejected, and on Linux Landlock adds kernel-level filesystem confinement
• Structured patching: apply_patch stages edits, checks them against a baseline, and applies or rolls back across multiple files atomically
• Interactive sessions: execcommand starts a REPL or debugger under a real PTY, writestdin feeds it across turns, readoutput pages long output, and killcommand cleans up
• Two transports: newline-delimited JSON-RPC over stdio, or Streamable HTTP, with MCP protocol eras 2026-07-28 and 2025-11-25 (plus 2025-06-18 compatibility) and no sessions on either
• Context budgeting: tool results are summarized, paginated, and capped, with concise agent-facing content and complete machine results in structuredContent
• Project instructions: root AGENTS.md and CLAUDE.md files load automatically and return in the instructions of initialize or server/discover
• Remote and sandboxed operation: authenticated HTTPS tunnels, a Docker sandbox image, and a Cloudflare Worker that dispatches an ephemeral cloud sandbox as an MCP tool call
• Desktop front end: an optional GUI with per-workspace profiles, server and tunnel controls, credential setup, and health checks, in English and Simplified Chinese
• Reduced tool surface: --tool-profile read-only and --tool-profile compat-readonly-all narrow what is exposed
• Telemetry controls: anonymous per-tool success and latency counters only, disabled with CODINGTOOLSMCPTELEMETRY=off or DONOT_TRACK=1, and off automatically in CI