Skip to main content
Glama

Server MCP Agent

ChatGPT-first, host-resident Linux server MCP — an open-source Python MCP server with OAuth, explicit workspace policies, system monitoring, Docker/systemd diagnostics, safe file edits and human-approved operations.

Status: v0.1 experimental. Not audited or penetration-tested. Install on a disposable VM before using a production host. It is deliberately not an unauthenticated root shell. SSH remains an emergency recovery channel.

Features

Tool

Scope

Effect

whoami, host_status, list_workspaces

server:read

Identity and host health

list_files, read_text

server:read

Workspace-bounded UTF-8 files, hashes

git_status, git_diff

server:read

Inspect repositories

list_processes, listening_ports

server:read

Process/network diagnostics

service_status, service_logs

server:read

Allowlisted systemd services

docker_containers, docker_logs

server:read

Allowlisted Docker resources

recent_audit

server:read

Recent approval and mutation events

write_text

server:write

Optional atomic compare-and-swap workspace editing

request_operation, execute_approved

server:operate

Human-approved restarts/runbooks

Administrative operations require BOTH an OAuth access token with server:operate AND permissions.operate_enabled=true AND approval via local CLI, with five-minute, one-use requests. There is no tool to self-approve.

Related MCP server: ChatGPT VPS MCP

Architecture

ChatGPT custom MCP app
       |
 HTTPS + OAuth 2.x (OIDC/JWT audience-scoped)
       |
 Caddy/NGINX TLS reverse proxy
       |
 127.0.0.1:8765/mcp       <-- MCP Python SDK Streamable HTTP
       |
 non-root server-mcp service
       |---- allowlisted workspaces / Git
       |---- systemd and journalctl read-only
       |---- Docker diagnostics (optional; socket access has high privilege!)
       |---- out-of-band operator approvals in SQLite
       |---- predefined runbooks, never arbitrary model-supplied shell

Important requirements

  • Linux, Python 3.11+, systemd for service management, optionally docker, git, ss, journalctl.

  • An external OAuth 2.1/OIDC authorization server (Keycloak/Auth0/etc) that issues JWT access tokens with the exact MCP resource URL in the aud claim, proper scope strings and RS256/ES256 signing. Server MCP is a resource server, not an identity provider.

  • Public HTTPS address or supported secure MCP tunnel. The agent binds only to localhost.

  • Availability of write tools in ChatGPT depends on its plan/workspace permissions and whether the custom MCP app is enabled.

Quick deployment

Follow docs/DEPLOY.md and configure config.example.toml. This repository does not ship a remotely executable curl-to-shell installer.

python3 -m venv .venv
.venv/bin/python -m pip install -e '.[dev]'
.venv/bin/pytest -q

Do not run the MCP service as root. See SECURITY.md, THIRD_PARTY.md, and docs/CODEX_DEPLOY_PROMPT.md.

Source inspirations

Built on the official MIT-licensed MCP Python SDK, psutil, and PyJWT. The server-operations model is informed by MIT-licensed fleet and Dozor. Their code has not been copied or vendored: tools are newly implemented around established dependencies. GPL-3.0 1Panel is not copied.

MIT license. Experimental and provided without warranties.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Turns any Linux server into an AI-agent-accessible machine over HTTPS, allowing MCP clients like ChatGPT, Claude, and Grok to securely control files, run shell commands, inspect system state, query SQLite, and work with git behind a bearer token.
    136 npm
    4
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables ChatGPT to securely inspect and administer a Linux VPS over Streamable HTTP, with OAuth protection, workspace file tools, and optional root command execution.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables ChatGPT to securely control remote development servers over OAuth-protected MCP, exposing workspace-bounded tools for file editing, command execution, Git operations, and running Codex or GitHub Copilot subagents.
    10 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP clients such as ChatGPT and Claude to administer Linux or macOS hosts through authenticated Streamable HTTP, including running shell commands, reading and writing files within a workspace, listing directories, and retrieving system metrics.
    110 PyPI
    1
    MIT