NTLx

ServerFS MCP — Development skill for Claude Code

Development community

Secure self-hosted MCP server exposing selected Linux directories as controlled workdirs via OpenAI Secure MCP Tunnel — read-only by default, opt-in mutations, binary transfer, and optional Codex/Clau.

How to install ServerFS MCP

This entry records only its repository, not the path inside it, so there is no exact command to give. Open NTLx/ServerFS_MCP and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What ServerFS MCP does

Alternatives in Development

Claudia — A powerful GUI app and Toolkit for Claude Code - Create custom agents, manage interactive Claude Code sessions 21k ★
Vibekit — A simple SDK for safely running Codex, Gemini CLI, and Claude Code in a secure sandbox 1.7k ★
Sandbox-agent (Rivet) — Run Claude Code and other coding agents in sandboxes controlled over HTTP 1.2k ★

README

ServerFS MCP

ServerFS MCP is a secure MCP server that exposes explicitly configured Linux directories as controlled workdirs to AI agents, **read-only by default** with opt-in per-workdir file mutation.

Agents reach your directories through the **OpenAI Secure MCP Tunnel**. They can list, find, search, read and stat files anywhere you mount; optionally transfer bounded whole binary files; and, in workdirs you explicitly mark read-write, create, edit, delete or revision-guarded replace files through narrow tools. Nothing else: no shell, no command execution, no unguarded overwrite, no recursive delete, no escape from the directories you configure.

服务器上有哪些 workdir？        → list_workdirs
看一下 projects 根目录有什么    → list_directory
找所有 docker compose 配置     → find_files
搜索哪里配置了 DATABASE_URL    → search_text
打开对应配置文件               → read_text_file / stat_file
下载 PNG / ZIP 等原始字节       → download_binary_file（可选）
上传或受控替换二进制文件         → upload_binary_file（可选）
新建一个 Markdown 设计文档      → create_text_file
把端口 8080 改成 8081          → edit_text_file
删掉过期的构建产物              → delete_file
建一个 docs/v0.2 目录           → create_directory
删掉空的临时目录                → delete_directory

Architecture

Linux filesystem
   → Docker bind mounts (/workdirs/01..16)
        read-only by default
        read-write only where WORKDIR_XX_READ_ONLY=false
   → ServerFS MCP (streamable-http on :8000, internal network only)
        read tools:  list / find / search / read / stat
        mutation tools: create / edit / delete (read-write workdirs only)
        optional binary path: download / upload / revision-guarded replace
        optional ChatGPT file ingress → isolated sidecar → temporary HTTPS file URL
        optional Agent path: nine Agent tools → host Agent Bridge → Codex/Claude
          optional experimental Jev advisor → preflight + runtime routing + approval advice
   → OpenAI Secure MCP Tunnel (official tunnel-client container, outbound-only)
   → ChatGPT