English | 简体中文
Give immoderate AI chat aliases supplier a safe brace of hands connected your codebase.
Coding Tools MCP is simply a model-neutral coding runtime served complete the Model Context Protocol: record reference and search, system multi-file patches, bid execution, interactive sessions, and git — 1 server that immoderate MCP customer tin drive. Claude Desktop, Claude Code, Cursor, Cline, aliases an supplier you build yourself each get the same 20 battle-tested tools, confined to 1 workspace, gated by support modes.
- It turns a chat app into a coding agent. Claude Desktop — aliases immoderate MCP chat customer — gets existent repo entree pinch the subscription you already have. No other merchandise required.
- Safety is the product, not an afterthought. One workspace guidelines per server. Absolute paths, .. traversal, and symlink escapes are rejected. Permission modes gross web access, ammunition description , inline scripts, and destructive commands. On Linux, Landlock adds kernel-level filesystem confinement.
- It is model- and vendor-neutral. A fixed, truthfully annotated catalog — no floor plan switching, nary note games. Swap models aliases clients freely; the runtime and its behaviour enactment put.
- It is engineered for discourse windows. Results are summarized, paginated, and capped by design; serialized tool-result bytes dropped 37% release-over-release connected the deterministic dogfood workload pinch unchanged task completion.
Run it pinch whichever toolchain you already person (the server is Python ≥ 3.11 from PyPI; the npm package is simply a bladed launcher that starts it via uv or pipx):
Wire it into Claude Desktop, Claude Code, Cursor, aliases Cline — the JSON is the same everyplace (swap uvx for npx if you for illustration Node):
Then inquire your client: "run the trial suite and hole the first failure."
Prefer HTTP? Drop --stdio and the server speaks Streamable HTTP on http://127.0.0.1:8765/mcp (MCP 2025-11-25, pinch 2025-06-18 compatibility). A one-line installer, per-client walkthroughs, and troubleshooting unrecorded successful docs/quickstart.md and docs/mcp-client-config.md.
1. Make Claude Desktop your coding agent. The config supra is each it takes — the chat model you already salary for tin now read, patch, test, and commit-review a existent repository.
2. Code connected your ain instrumentality from anywhere.
Loopback hindrance + authenticated HTTPS passageway (cloudflared, ngrok, or Microsoft Dev Tunnel). Point claude.ai connected your telephone at https://<tunnel-host>/mcp and thrust your location workstation from anywhere. Bearer tokens and OAuth 2.1 + PKCE (with RFC 7591 move registration) are built in. → docs/remote-mcp.md
3. Let an supplier loose connected untrusted codification — wrong a disposable sandbox.
A containerized server pinch toolchains and caches preconfigured, safe to point at a sketchy PR and destruct afterwards. → docs/docker.md
4. Spin up a unreality sandbox pinch 1 MCP call. The bundled Cloudflare Worker power plane exposes start_coding_tools_sandbox arsenic an MCP tool: 1 telephone dispatches a GitHub Actions runner that boots the Docker sandbox and publishes it down an authenticated Cloudflare Tunnel. Ephemeral compute, nary server of your own.
5. Drive it from a GUI.
Per-workspace profiles, server and passageway start/stop, credential setup with clipboard helpers, unrecorded wellness checks. English and 简体中文.
6. Keep an interactive convention alive. exec_command starts a REPL or debugger nether a existent PTY; write_stdin feeds it crossed turns; read_output pages agelong output; kill_session cleans up. Long-running processes are first-class, pinch deadline watchdogs and bounded buffers.
7. Give your ain supplier production-grade hands. Building an supplier loop with the Anthropic SDK aliases thing else? Don't hand-roll record and exec devices — speak MCP to this server and inherit the full information boundary. → docs/embedding.md
One stable, truthfully annotated group — support modes alteration command policy, ne'er which devices the exemplary sees. apply_patch is the sole file-mutation primitive: staged, baseline-checked, atomic crossed files, with rollback.
| Files & search | read_file · list_dir · list_files · search_text · apply_patch · view_image |
| Execution | exec_command · write_stdin · read_output · kill_session · request_permissions |
| Git | git_status · git_diff · git_log · git_show · git_blame |
| Runtime | server_info · check_exec_environment · get_default_cwd · set_default_cwd |
Root AGENTS.md/CLAUDE.md files load into the initialize context automatically. Tool contented is concise agent-facing text; structuredContent carries the complete instrumentality result. Schemas and result envelopes: docs/tools-and-schemas.md · docs/runtime-contract-v0.2.md.
| safe (default) | day-to-day supplier work | file devices and vetted commands; network-looking commands, ammunition description , inline scripts, and destructive commands each require definitive permission |
| trusted | local development | opens network, ammunition description , and inline scripts; keeps concealed filtering and destructive-command checks |
| dangerous | isolated containers/VMs only | disables exec_command support gates; workspace way boundaries still apply |
Recursive listing and hunt exclude .git, node_modules, build outputs, virtualenvs, and caches. Commands tally pinch workspace-bound cwd, scrubbed environment, timeouts, and output caps. Linux hosts pinch Landlock get kernel-enforced filesystem confinement; different platforms get an explicit warning — this is still not a complete OS sandbox, truthful usage the Docker image or a VM for genuinely untrusted work. Details: SECURITY.md · docs/security-boundary.md · docs/permission-modes.md
The server sends anonymous usage telemetry (per-tool success/latency counters and version/platform dimensions — ne'er paths, arguments, commands, aliases file contents) to thief prioritize fixes. Disable it with CODING_TOOLS_MCP_TELEMETRY=off aliases DO_NOT_TRACK=1; it is automatically off in CI. CODING_TOOLS_MCP_TELEMETRY=debug prints each arena to stderr instead of sending. The afloat arena database and guarantees are in docs/telemetry.md.
Evidence, Dogfood and SWE-bench
Every merchandise ships done a tag-triggered pipeline successful which the compliance suite, real-workload benchmark, and SWE-bench harness tally from the aforesaid commit that publishes to PyPI and npm — some via trusted publishing, npm with provenance. Dogfood ratio metrics are reproducible (make dogfood-smoke) and checked successful nether reports/. This repository does not declare a model-generated SWE-bench leaderboard consequence — see docs/swe-bench.md for precisely what is and is not measured. More: COMPLIANCE.md · BENCHMARK.md · docs/dogfood.md
The afloat gross matrix is successful docs/ci-and-tests.md.
This task is licensed nether the Apache License 2.0.
If you usage code, documentation, important implementation details, or derivative activity from this project, sphere the copyright notice, license notice, and NOTICE file, and intelligibly property the original project.
Project: Coding Tools MCP
Author: Coding Tools MCP Contributors
Source: https://github.com/xyTom/coding-tools-mcp
Citation metadata is disposable successful CITATION.cff.
English (US) · 
Indonesian (ID) ·