SECURE MCP FOR LINUX · WINDOWS · MACOS WORKDIRS

Give AI access.Keep the boundary explicit.

Expose selected workdirs through native stdio or standard Streamable HTTP. Read-only by default, with guarded writes and bounded binary transfer; API Key, OAuth 2.1, OpenAI Tunnel, file ingress, Agent delegation, and Agent Skills stay explicit capabilities. v0.23.3 supports independently gated Deterministic Repo Ops on Linux Host Bridge, validated Apple Silicon macOS, and validated native Windows 11 x64, without Agent fallback.

Get started View source

No shellNo escapeScoped writesMIT licensed

CONTROLLED DATA PATH

ChatGPTMCP client

Secure MCP Tunneloutbound only

ServerFS MCPv0.24.2

FILESYSTEMscoped workdirs

MUTATIONSrevision guarded

BINARY I/Obounded · optional

REPO OPSv0.23.3 · Linux + validated macOS + Windows

AGENT BRIDGEnative host · optional

Scoped Workdirs

/srv/projectsread-only by default

Agent Bridge

user-owned socket

Codex Claude Qoder ACP

STANDARD MCP CONNECTIVITY

Connect your way. Keep one policy boundary.

Use the transport and authentication model that fits the host. ServerFS keeps filesystem authorization separate from ingress choice.

stdio

Native local

Windows / macOS native MCP without a network listener

Streamable HTTP

Standard remote MCP

Loopback by default; place authenticated TLS ingress in front for remote use

Static API Key

Lightweight auth

One high-entropy secret for simple remote deployments

OAuth 2.1

Identity-aware auth

Optional brokered authentication for production remote deployments

OpenAI Tunnel

Optional ChatGPT ingress

Authenticated outbound tunnel path; no longer the generic MCP default

Cloudflare Tunnel

Linux + macOS + Windows stable

v0.24.0 Linux / v0.24.1 Apple Silicon / v0.24.2 Windows

HTTP setup API Key OAuth 2.1

PROGRESSIVE CAPABILITY

Start narrow. Expand deliberately.

ServerFS grows by explicit opt-in. Each added surface is bounded, independently gated, and visible in the tool contract.

1101

Filesystem

safe read + guarded mutation surface

1302

+ Binary

bounded whole-file transfer

1503

+ Repo Ops

v0.23.3 · Linux + validated macOS + Windows

2104

+ Agent

native delegation + model discovery

2705

v0.24.0 full

binary + Agent + Repo Ops enabled

THREE DEPLOYMENT SHAPES

One contract. Native boundaries on every platform.

The MCP capability model stays consistent. Deployment, filesystem containment, transport, and lifecycle follow the operating system instead of pretending every host is Linux.

DOCKER-NATIVE SERVER DEPLOYMENT

Containers define the outer boundary.

Linux is the server-oriented shape: Docker Compose on amd64 or arm64, standard Streamable HTTP by default, and optional overlays for authentication, file ingress, the host Bridge (Agent delegation and v0.23 Repo Ops), the OpenAI Tunnel, or the Linux v0.24 Cloudflare Tunnel.

Linux deployment guide

NATIVE EXECUTION PATHLinux

01INGRESS

Streamable HTTP

Authenticated TLS edge · optional OpenAI Tunnel

02RUNTIME

ServerFS container

Policy-bound MCP surface · no shell

03BOUNDARY

Bind-mounted workdirs

Only explicitly configured paths are visible

04HOST BRIDGE

Optional host capability

Agent delegation and v0.23 Repo Ops stay outside the container

WHY THIS SHAPE

Container boundary

Compose makes runtime and filesystem mounts explicit, so adding capability never silently expands host access.

Remote by design

Linux is the server-facing shape: HTTP is first-class, while authentication and Tunnel remain independent overlays.

linux · serverfs

$ docker compose pull
$ docker compose -f compose.yml -f compose.http.yml up -d serverfs-mcp

APPLE-NATIVE USER DEPLOYMENT

Darwin-native semantics, owned by the current user.

The macOS shape is native arm64 on Apple M-series Macs with local APFS workdirs. ServerFS uses descriptor-relative Darwin filesystem primitives and Apple SMAppService for persistent per-user Tunnel and Agent Bridge lifecycle.

macOS native guide

NATIVE EXECUTION PATHmacOS

01LIFECYCLE

SMAppService

Current-user persistence · no LaunchDaemon

02TRANSPORT

Native stdio

No MCP network listener

03FILESYSTEM

Darwin FD backend

Descriptor-relative traversal · symlinks fail closed

04WORKDIR

Local APFS

TCC and user permissions remain authoritative

WHY THIS SHAPE

Current-user ownership

Persistence uses Apple’s user-level service model instead of root daemons or hand-installed LaunchAgents.

Native containment

ServerFS follows Darwin file-descriptor semantics and never bypasses macOS privacy controls.

macos · serverfs

$ serverfs doctor --config serverfs.toml
$ serverfs service install --config serverfs.toml --env-file .env

WINDOWS-NATIVE USER DEPLOYMENT

NTFS-native semantics without administrator privileges.

The Windows shape runs natively on Windows 11 x64 with local NTFS. A HANDLE-relative Rust kernel provides filesystem containment, while a current-user Task Scheduler watchdog owns persistent lifecycle without SCM, LocalSystem, or UAC elevation.

Windows native guide

NATIVE EXECUTION PATHWindows

01LIFECYCLE

Task Scheduler

Current-user watchdog · least privilege

02TRANSPORT

Native stdio

No MCP network listener

03FILESYSTEM

Rust NTFS kernel

HANDLE-relative traversal · reparse points blocked

04WORKDIR

Local NTFS

No network shares · no elevation

WHY THIS SHAPE

No administrator path

Install, run, recover and remove stay current-user operations: no SCM, LocalSystem or stored account password.

Measured native boundary

The prebuilt abi3 kernel enforces NTFS-specific containment instead of emulating POSIX filesystem semantics.

windows · serverfs

$ serverfs doctor --config serverfs.toml
$ serverfs service install --config serverfs.toml --env-file .env

ARCHITECTURE

Capability, not ambient authority.

Every layer has one job. Optional powers are explicit, narrow, and independently gated.

MCP hostsClaude Code · Codex · Qoder · ChatGPT · harnesses

BOUND

Ingressstdio · Streamable HTTP · optional OpenAI / Cloudflare Tunnel

BOUND

ServerFS MCP CorePolicy, path confinement, revisions, audit

BOUND

Deployment boundaryLinux Docker · Windows/macOS native stdio

BOUND

Scoped workdirsRead-only unless explicitly released

BOUND

SECURITY BY CONSTRUCTION

Security is the shape of the interface.

ServerFS does not rely on one sandbox or one network assumption. Filesystem policy, transport validation, deployment isolation, and Agent boundaries reinforce each other.

Narrow primitives. Explicit boundaries. No ambient authority.

Read-only by default

No shell or generic executor

Scoped workdir boundary

Revision-guarded mutation

No recursive delete

Transport Host / Origin validation

No public bind by default

Agent Bridge is opt-in

OPTIONAL AGENT BRIDGE

Native agents stay on the host.

The optional Agent Bridge delegates structured tasks to native Codex, Claude and Qoder runtimes, plus operator-configured ACP v1 profiles using an absolute executable and fixed argv. OpenCode 2.1.2 with opencode/glm-5.3-flash-free passed real end-to-end acceptance on Linux, macOS and Windows, including prompts, persisted-session continuation, and active-tool cancellation/cleanup. ACP model discovery/override, elicitation, client filesystem and terminal are unsupported; capabilities remain conservative. Windows v0.14.0 uses current-user Task Scheduler persistence with a windowless watchdog and layered recovery; macOS v0.13.2+ uses Apple SMAppService for persistent per-user lifecycle. Provider defaults stay native; request-scoped model overrides remain explicit, while optional Jev advisors can add pre-submit advice without becoming execution authority.

Explore Agent Bridge ACP Guide Explore Jev Advisors

MCP CONTAINERServerFS

bridge.sock

HOST USER SERVICEAgent Bridge

Codex Claude Qoder ACP

JevADVISORY ONLY

policy decides

serverfs · quick start

$ git clone https://github.com/NTLx/ServerFS_MCP.git
$ cd ServerFS_MCP
$ cp .env.example .env
$ docker compose pull
$ docker compose -f compose.yml -f compose.http.yml up -d serverfs-mcp
$ docker compose -f compose.yml -f compose.http.yml ps

✓ serverfs-mcp      healthy
✓ http://127.0.0.1:8000/mcp

SELF-HOSTED

One controlled service.
Your machine. Your policy.

Start with standard Streamable HTTP on Linux, then add only the capabilities you need. OpenAI Tunnel remains available for ChatGPT, while the v0.24.0 Cloudflare Tunnel is an optional Linux Docker ingress with separate API Key/OAuth admission. File ingress, v0.23 Repo Ops, Agent delegation, Agent Skills, and Jev stay explicit opt-ins.

Read the deployment guide

PORTABLE AGENT SKILLS

Operational knowledge ships with the project.

The published v0.24.2 release carries seven Agent Skills and one skills-only Plugin. Linux Cloudflare Tunnel guidance ships within the existing tunnel skill, preserving the same seven-skill packaging and a separate HTTP admission boundary.

Explore Agent Skills

SERVERFS MCP

Make your server legible to AI.
Keep the boundary explicit.

Read the docs GitHub

Give AI access.Keep the boundary explicit.

Connect your way. Keep one policy boundary.

Native local

Standard remote MCP

Lightweight auth

Identity-aware auth

Optional ChatGPT ingress

Linux + macOS + Windows stable

Start narrow. Expand deliberately.

Filesystem

+ Binary

+ Repo Ops

+ Agent

v0.24.0 full

One contract. Native boundaries on every platform.

Containers define the outer boundary.

Darwin-native semantics, owned by the current user.

NTFS-native semantics without administrator privileges.

Capability, not ambient authority.

Security is the shape of the interface.

Native agents stay on the host.

One controlled service.Your machine. Your policy.

Operational knowledge ships with the project.

Make your server legible to AI.Keep the boundary explicit.

One controlled service.
Your machine. Your policy.

Make your server legible to AI.
Keep the boundary explicit.