List projects registered with the local MCP runner and their access mode.

Return project root, access mode, managed-worktree metadata, and Git branch state.

List one directory inside a registered project while hiding sensitive paths.

Recursively find files/directories by name substring without traversing sensitive paths, symlinks, or dependency/build directories.

Search for a fixed text string in project files with bounded output; regex and shell execution are not used.

Read one UTF-8 text file inside a registered project.

Read up to 20 UTF-8 text files from one registered project.

Return size and SHA-256 for an existing text file.

Create a directory path only in a write-enabled non-protected project/worktree; symlink traversal is blocked.

Create a new UTF-8 file in a write-enabled project. Existing files are never overwritten.

Replace exactly one text block in an existing file using an expected SHA-256 concurrency guard.

Delete one existing file only when the caller supplies its exact current SHA-256.

Return safe Git status while omitting sensitive-path entries.

Return a bounded diff excluding sensitive files. Supports working-tree, staged, or ref-to-ref diffs.

Return recent commit metadata, optionally scoped to one safe path.

List local Git branches and the current branch.

Create an mcp/* branch without checking it out. main/master and arbitrary branch names are not permitted.

Create/register an isolated writable worktree on an mcp/* branch under the runner worktree directory.

Remove a clean runner-managed worktree and unregister it. Dirty worktrees are refused; the branch is retained.

Stage and commit only non-sensitive changes in a writable runner-managed mcp/* worktree. Hooks and GPG signing are disabled; push is not available.

List package.json scripts and report whether sandboxed execution is supported for this project. executionSupported answers 'can this environment run scripts at all'; executionEnabled folds in the kill switch.

Execute an allowlisted, hash-pinned npm/pnpm script inside a macOS Seatbelt sandbox. network is always 'none'; script execution is confined to a runner-managed READ_WRITE mcp/* worktree. A non-zero script exit code is a successful MCP call (the script ran; the test failed).

Query metadata for a GitHub repository under an allowlisted organization. Returns existence, owner, visibility, default branch, fork/archived flags, and repository URL.

Create a new repository under an allowlisted GitHub organization with specified visibility (public or private). Idempotent: returns ALREADY_EXISTS if repository already exists with matching visibility. Does NOT initialize with README/license/gitignore, does NOT push code, does NOT configure remotes.