ServerFS MCP
ServerFS MCP exposes explicitly configured Linux directories as controlled workdirs through the Model Context Protocol.
It is read-only by default. Administrators can opt individual workdirs into narrow file mutations, bounded whole-file binary transfer, and an isolated, separately gated ChatGPT file-parameter ingress path. A host-side Agent Bridge for Codex or Claude remains optional, and can itself opt into advisory-only TypeSafe Jev support without changing the MCP tool surface.
Capability surfaces
Section titled “Capability surfaces”| Surface | Tools | Enabled by |
|---|---|---|
| Filesystem | 11 | Base deployment |
| Filesystem + binary | 13 | Binary transfer enabled |
| Filesystem + Agent | 19 | Agent overlay enabled |
| Full capability | 21 | Binary + Agent enabled |
There is no shell, generic command executor, recursive delete, or unguarded overwrite.
Start here
Section titled “Start here”- Getting Started — deploy the base server with the OpenAI Secure MCP Tunnel.
- Configuration — define workdirs and effective per-workdir policy.
- Architecture — understand the container, tunnel, and Agent Bridge boundaries.
- Security Model — review the defense-in-depth model.
- Binary Transfer — enable bounded download/upload, including optional ChatGPT file-parameter ingress.
- Agent Bridge — opt into structured Codex/Claude delegation.
- Jev Advisors — mainline-experimental task preflight, runtime routing advice, and approval advice inside the host Bridge.
For implementation detail and the complete operational reference, see the repository README.