ServerFS MCP
ServerFS MCP exposes explicitly configured directories — Linux containers, native Windows since v0.10.0, native macOS since v0.13.0 — as controlled workdirs through the Model Context Protocol.
Current stable release: v0.24.2. Optional Linux Docker Cloudflare Tunnel shipped in v0.24.0 after isolated ChatGPT, SSE and session-reconnect acceptance. Native macOS Cloudflare shipped in v0.24.1. Native Windows Cloudflare shipped in v0.24.2. Two independent same-user Task Scheduler owners passed public ChatGPT tools and cross-ingress file operations. The public SSE gate passed with 75.0/70.0/65.0-second holds, approximately 15-second keepalives, same-session tools/list 200 (27 tools), and new-session 200. The operator waived Windows full-generation restart/recovery testing on 2026-11-10; it was not tested and did not pass. Connector-only restart and lossless SSE replay are not claimed. Both owners share one Agent Bridge/Repo Ops service, which must remain available while Cloudflare depends on it. See Cloudflare Tunnel, Windows Native and macOS Native. ServerFS is standards-first: compatible MCP hosts can use native stdio or standard Streamable HTTP.
v0.22.0 adds Correlated Agent Diagnostics through the existing private Agent Bridge RPC: serverfs diagnostics snapshot for a bounded Bridge snapshot and serverfs diagnostics task <task-id> for one retained task. Diagnostic state is process-local and bounded; there is no new MCP tool, listener, persistent trace store, OpenTelemetry dependency, or telemetry egress. Phase F passed on Linux/VPS, supported macOS, and supported Windows; Phase G release-readiness acceptance is PASS. See v0.22 Phase G preflight.
It is read-only by default. Administrators can opt individual workdirs into narrow file mutations, bounded whole-file binary transfer, and an isolated, separately gated ChatGPT file-parameter ingress path. v0.23.3 supports independently gated Deterministic Repo Ops on Linux Host Bridge, validated native Apple Silicon macOS, and validated native Windows 11 x64 for bounded Git inspection, integrity-pinned named actions, explicit-file commit, exact current-upstream push, and fixed npm release actions for the validated package.json release shape without Agent delegation. A host-side Agent Bridge remains optional; Native Codex, Claude and Qoder plus configurable ACP v1 profiles provide Agent delegation; provider-neutral model discovery and request-scoped overrides remain runtime-dependent, with advisory-only TypeSafe Jev support. Windows stays native: MCP stdio over a prebuilt Rust/NTFS kernel wheel, with no Docker, WSL or MSVC; v0.14.0 also removes terminal/session lifetime from the normal Windows lifecycle.
Capability surfaces
Section titled “Capability surfaces”| Surface | Tools | Enabled by |
|---|---|---|
| Filesystem | 11 | Base deployment |
| Filesystem + binary | 13 | Binary transfer enabled |
| Filesystem + Repo Ops | 15 | Repo Ops enabled (Linux / validated native macOS / validated native Windows) |
| Filesystem + binary + Repo Ops | 17 | Binary + Repo Ops enabled |
| Filesystem + Agent | 21 | Agent overlay enabled |
| Filesystem + binary + Agent | 23 | Binary + Agent enabled |
| Filesystem + Agent + Repo Ops | 25 | Agent + Repo Ops enabled |
| Full v0.24.0 surface | 27 | Binary + Agent + Repo Ops enabled |
Stable v0.24.0 keeps the existing 11 / 13 / 21 / 23 filesystem, binary and Agent combinations and adds the independently gated Repo Ops combinations shown above on Linux Host Bridge, validated native Apple Silicon macOS, and validated native Windows 11 x64. There is no shell, generic command executor, recursive delete, or unguarded overwrite.
Start here
Section titled “Start here”- Getting Started — start with standard MCP connectivity; choose an authenticated ingress when remote access is required.
- Cloudflare Tunnel — Linux v0.24.0 stable Docker connector; native macOS v0.24.1.
- Configuration — define workdirs and effective per-workdir policy.
- Architecture — understand the MCP core, transport/ingress adapters, deployment and Agent Bridge boundaries.
- Security Model — review the defense-in-depth model.
- Static API Key — protect Linux remote Streamable HTTP with one optional shared bearer secret.
- OAuth 2.1 — protect Linux remote Streamable HTTP with optional OAuth, federated identity and exact stable-principal admission.
- Binary Transfer — enable bounded download/upload, including optional ChatGPT file-parameter ingress.
- Deterministic Repo Ops — v0.23.3 Linux Host Bridge, validated native Apple Silicon macOS, and validated native Windows 11 x64 capability for bounded Git/action/commit/push plus fixed npm release actions for
package.jsonrepositories, without Agent delegation. - Agent Bridge — opt into structured Codex/Claude/Qoder and configurable ACP profile delegation.
- Windows Native — native Windows 11 x64 + local NTFS deployment, including current-user persistent service lifecycle, health checks, Tunnel bootstrap, and Agent delegation.
- macOS Native — native Apple M-series + macOS 27 deployment, including the Darwin filesystem boundary, launchd Agent Bridge, and platform gate.
- Jev Advisors — optional experimental task preflight, five-way runtime routing, pre-submit model advice, and approval advice; v0.12 adds independent explicit Jev proxy routing.
This documentation site is the authoritative user and operator reference. The repository README is intentionally a concise project entry point.
For complete ACP setup, validation, task lifecycle, and troubleshooting, see the ACP Guide.