ServerFS
v0.7.1

SECURE MCP FOR LINUX WORKDIRS

Give AI access.Keep the boundary explicit.

Expose only the Linux workdirs you choose. Read-only by default, with guarded writes, bounded binary transfer, isolated ChatGPT file ingress, and an optional native Agent Bridge.

Get startedView source
No shellNo escapeScoped writesMIT licensed
CONTROLLED DATA PATH
ChatGPTMCP client
Secure MCP Tunneloutbound only
ServerFS MCPv0.7.1
FILESYSTEMscoped workdirs
MUTATIONSrevision guarded
BINARY I/Obounded · optional
AGENT BRIDGEstructured · optional
Scoped Workdirs
/srv/projectsread-only by default
Agent Bridge
user-owned socket
Codex Claude
internal network no published ports

PROGRESSIVE CAPABILITY

Start narrow. Expand deliberately.

ServerFS grows by explicit opt-in. Each added surface is bounded, independently gated, and visible in the tool contract.

1101

Filesystem

safe read + guarded mutation surface

1302

+ Binary

bounded whole-file transfer

2003

+ Agent

structured Codex / Claude delegation

2204

Full surface

binary + Agent Bridge enabled

ARCHITECTURE

Capability, not ambient authority.

Every layer has one job. Optional powers are explicit, narrow, and independently gated.

01
ChatGPTCalls narrow MCP tools
BOUND
02
Secure MCP TunnelOutbound-only control-plane connection
BOUND
03
ServerFS MCPPolicy, path confinement, revisions, audit
BOUND
04
Docker boundaryNo published ports · no Internet egress
BOUND
05
Scoped workdirsRead-only unless explicitly released
BOUND

SECURITY BY CONSTRUCTION

Security is the shape of the interface.

ServerFS does not rely on one sandbox or one network assumption. Filesystem policy, transport validation, container isolation, and Agent boundaries reinforce each other.

Narrow primitives. Explicit boundaries. No ambient authority.

01

Read-only by default

02

No shell or generic executor

03

Scoped workdir boundary

04

Revision-guarded mutation

05

No recursive delete

06

Transport Host / Origin validation

07

Internal-only MCP network

08

Agent Bridge is opt-in

OPTIONAL AGENT BRIDGE

Native agents stay on the host.

ServerFS brokers structured tasks over a user-owned Unix socket. Codex and Claude keep their native environment; optional Jev advisors add task preflight, routing, and approval context without becoming an authority or changing the MCP tool surface.

Explore Agent Bridge Explore Jev Advisors
MCP CONTAINERServerFS
bridge.sock
HOST USER SERVICEAgent Bridge
Codex Claude
JevADVISORY ONLY
policy decides
serverfs · quick start
$ git clone https://github.com/NTLx/ServerFS_MCP.git
$ cd ServerFS_MCP
$ cp .env.example .env
$ docker compose pull
$ docker compose up -d

✓ serverfs-mcp      healthy
✓ openai-tunnel     connected

SELF-HOSTED

One Compose stack.
Your machine. Your policy.

Start with the 11-tool filesystem surface. Add binary transfer, isolated ChatGPT file ingress, the Agent Bridge, or host-side Jev advisors only when the deployment actually needs them.

Read the deployment guide

SERVERFS MCP

Make your server legible to AI.
Keep the boundary explicit.

Read the docsGitHub