Coding Tools MCP

Simplified Chinese (default) · English version is folded below

Let ChatGPT, Claude Desktop, or any MCP-capable AI client genuinely read files, modify code, run commands, and inspect Git in your code repositories, and call local agents on a trusted personal development machine.

This is the 0.7 Workbench downstream branch of Coding Tools MCP. The project is evolved from the Apache-2.0 xyTom/coding-tools-mcp, retaining the upstream Git history, LICENSE, and NOTICE; on top of that, it adds substantial work related to Windows, concurrency/OAuth, personal_workstation, Agent Transport, and project continuity.

What does this thing do?

In one sentence: give AI a pair of “hands” that can safely operate the code repositories on your computer.

It provides a model-neutral local programming runtime via Model Context Protocol (MCP), including:

• reading, searching, listing directories, and structured multi-file patches;

• executing commands, persistent interactive terminals, and reading long-running task output;

• Git status / diff / log / show / blame;

• concurrency coordination, resource locks, leases, and owner-scoped long-running tasks;

• OAuth 2.1 / PKCE / Dynamic Client Registration;

• optional Host filesystem, Memo/ledger, Windows CUA;

• Agent Transport: currently supports Antigravity + OpenCode's status / send / read / continue / abort;

• the personal_workstation mode for trusted personal development machines.

Which optional capabilities a particular machine exposes is determined by that instance's server_info / tools/list.

What is the current status?

Current public release: v0.7.0-workbench.1.

This 0.7 code line has passed the source/local gate and has been validated in a real ChatGPT Connected App staging on the maintainer's Windows machine. Antigravity and OpenCode capability discovery, first call, same-session/conversation continuation, exact-job abort, and cleanup have all been verified with machine evidence.

The public repository's default branch main has completed an independent public-release gate; the GitHub Release also provides pinned-version Python wheel and sdist artifacts.

This does not mean “all machines and all MCP clients have been verified.” If you run into issues in a new environment, feel free to open an Issue or Discussion.

Simplest ways to use

Method A: Windows — clone and launch directly (recommended)

git clone https://github.com/biaobiao2233/coding-tools-mcp-workbench.git
cd coding-tools-mcp-workbench
.\scripts\start-workbench.ps1 -Workspace C:\你的\代码仓库

This launcher uses our current Workbench configuration by default:

• personal_workstation;

• Agent Transport enabled;

• telemetry off by default;

• destructive Git / recursive deletion still requires explicit authorization.

To start a local HTTP MCP:

.\scripts\start-workbench.ps1 -Workspace C:\你的\代码仓库 -Transport http -Port 8765

Method B: Install the GitHub Release wheel directly

If you don't want to clone the entire repository, you can install a pinned release directly:

python -m pip install https://github.com/biaobiao2233/coding-tools-mcp-workbench/releases/download/v0.7.0-workbench.1/coding_tools_mcp-0.7.0-py3-none-any.whl

Then:

coding-tools-mcp --permission-mode personal_workstation --stdio --workspace C:\你的\代码仓库

Currently, this downstream does not republish the upstream PyPI/npm package names. uvx coding-tools-mcp / npx coding-tools-mcp may still resolve to the upstream package; to make sure you are using this project, clone from GitHub or use the Release wheel above.

Example MCP client configuration

On Windows, you can have the client call the launcher in the checkout directly:

{
  "mcpServers": {
    "coding-tools": {
      "command": "pwsh",
      "args": [
        "-NoProfile",
        "-File",
        "C:\\path\\to\\coding-tools-mcp-workbench\\scripts\\start-workbench.ps1",
        "-Workspace",
        "C:\\你的\\代码仓库"
      ]
    }
  }
}

Then you can simply tell the AI: “Run the tests and fix the first failure.”

Why did we build this downstream?

The original project already provides a solid MCP coding runtime. We mainly keep pushing forward along these lines:

1. Personal Workstation: stop a trusted personal development machine from being blocked everywhere by overly conservative default permissions, while retaining gates on genuinely dangerous operations.

2. Windows reliability: Job Objects, process tree ownership, bounded scan, managed runner/watchdog, release/rollback.

3. Real ChatGPT Connected App: not just local self-tests, but also require verification of OAuth, tool contracts, and lifecycle in a real Connector environment.

4. Agent Transport: make MCP more than “execute shell”; it can also uniformly drive Antigravity and OpenCode, with Claude Code planned for the future.

5. Project Continuity / Workbench: separate Worker Claim, independent Review, Candidate, and Accepted State, so “AI said it’s done” does not automatically count as passed.

Which projects did we reference?

Here we deliberately distinguish code lineage / API integration / design inspiration, to avoid describing “learned from a project’s ideas” as “used its source code.”

See Code Lineage, Prior Art, and Design Influences for full details.

Security boundaries

Truly untrusted code should still be run in Docker / VM. See SECURITY.md and docs/security-boundary.md for detailed boundaries.

Telemetry

Telemetry in this downstream is off by default. Events are sent only when the operator explicitly sets telemetry=on and provides both a self-controlled HTTPS endpoint and a write-only key. DO_NOT_TRACK=1 and CI force it off.

Chinese documentation navigation

The following core entry points are now Chinese by default, with English folded at the bottom of the same file:

• Quick Start

• Roadmap

• Contributing Guide

• Code Lineage, Prior Art, and Design Influences

Lower-level protocol contracts, test reports, and schema documentation remain primarily English, to avoid translation drift from code/API names:

• Tools and Schemas

• Runtime Contract

• Permission Modes

• Remote MCP

• Windows Managed Runner

• Troubleshooting

Roadmap

The next main research/implementation directions:

• Claude Code Agent Transport provider;

• provider plug-in boundary;

• Orca optional orchestration backend;

• Web ChatGPT-supervised long-running workbench;

• multi-machine, signed/reproducible releases, Linux/macOS parity.

See ROADMAP.md for detailed progress.

Contributing

These directions are especially welcome: Windows portability, Agent provider adapter, OAuth/Connected App interoperability, adversarial testing of permissions/process lifecycle, Orca integration experiments, Linux/macOS isolation, and Chinese/English documentation improvements.

See CONTRIBUTING.md.

License and origin

This project uses the Apache License 2.0. Please retain the copyright notice, license notice, and NOTICE.

Downstream: https://github.com/biaobiao2233/coding-tools-mcp-workbench Upstream: https://github.com/xyTom/coding-tools-mcp

Coding Tools MCP

English | 简体中文

Give any AI chat or agent a safe pair of hands on your codebase.

Downstream 0.7 workbench branch. This codebase is derived from xyTom/coding-tools-mcp under Apache-2.0 and preserves the upstream history and attribution. The downstream branch adds substantial Windows/runtime/agent-transport work. It is currently shared from source; the upstream PyPI/npm package names are intentionally not republished by this fork yet. See Lineage and design influences.

Coding Tools MCP is a model-neutral coding runtime served over the Model Context Protocol: file reading and search, structured multi-file patches, command execution, interactive sessions, git, optional reviewed host access, concurrency/resource leases and local-agent transport — one server that an MCP client can drive. The runtime catalog is capability-gated: server_info is the source of truth for which optional host/Memo/CUA/Agent tools are exposed on one installation.

Downstream 0.7 status

The exact source baseline b0f44ef... has passed local/source gates and a real ChatGPT Connected-App staging trial on the maintainer's Windows machine. In that environment, Antigravity and OpenCode capability discovery remained machine-verifiable, both provider continuation paths worked, and exact-job abort/cleanup were exercised.

That does not mean every machine/client is proven. The GitHub-source public release gate has now passed, the downstream repository is public, and v0.7.0-workbench.1 is available as a GitHub Release with wheel + sdist artifacts. Production promotion remains a separate gate in this project's development process.

Highlights added by the downstream line include:

• Windows Job Object/process-lifecycle hardening and bounded scan behavior;

• server-global concurrency coordination, resource locks and leases;

• authenticated owner-scoped long-running jobs across short-lived HTTP calls;

• ChatGPT-oriented OAuth refresh/restart hardening;

• opt-in personal_workstation mode for trusted developer machines;

• optional host-root, Memo/ledger and Windows computer-use surfaces;

• Agent Transport for Antigravity and OpenCode with machine-backed capability discovery, provider session correlation, continuation and cancellation.

See ROADMAP.md for what is validated versus still research.

Why people use it

• It turns a chat app into a coding agent. Claude Desktop — or any MCP chat client — gets real repo access with the subscription you already have. No extra product required.

• Safety is the product, not an afterthought. One workspace root per server. Absolute paths, .. traversal, and symlink escapes are rejected. Permission modes gate network access, shell expansion, inline scripts, and destructive commands. On Linux, Landlock adds kernel-level filesystem confinement.

• It is model- and vendor-neutral. A fixed, truthfully annotated catalog — no profile switching, no annotation games. Swap models or clients freely; the runtime and its behavior stay put.

• It is engineered for context windows. Results are summarized, paginated, and capped by design; serialized tool-result bytes dropped 37% release-over-release on the deterministic dogfood workload with unchanged task completion.

Quickstart — downstream source checkout

Windows: run the accepted Workbench profile directly

Clone this downstream repository, then run:

.\scripts\start-workbench.ps1 -Workspace C:\path\to\your\repo

This launcher starts the accepted Workbench profile rather than the upstream restricted default: personal_workstation permission mode, Agent Transport enabled, and telemetry off. Destructive Git operations and recursive filesystem deletion still require explicit permission. Antigravity and OpenCode are optional: the MCP server starts without them, while agent_status reports whichever providers are actually installed on the machine.

For a loopback HTTP endpoint instead of stdio:

.\scripts\start-workbench.ps1 -Workspace C:\path\to\your\repo -Transport http -Port 8765

The script uses uv when available. Otherwise it creates a local .workbench-venv, installs this checkout, and launches the exact code cloned from GitHub.

Install from this checkout, or use the fixed GitHub Release wheel, rather than the upstream PyPI/npm names:

git clone https://github.com/biaobiao2233/coding-tools-mcp-workbench.git
cd coding-tools-mcp-workbench
python -m pip install -e .

uvx coding-tools-mcp and npx coding-tools-mcp currently refer to the upstream published packages, not this downstream 0.7 branch.

Fixed Release wheel:

python -m pip install https://github.com/biaobiao2233/coding-tools-mcp-workbench/releases/download/v0.7.0-workbench.1/coding_tools_mcp-0.7.0-py3-none-any.whl

On Windows, point MCP clients at the checkout launcher so the client receives the downstream Workbench build rather than the upstream registry package:

{
  "mcpServers": {
    "coding-tools": {
      "command": "pwsh",
      "args": [
        "-NoProfile",
        "-File",
        "C:\\path\\to\\coding-tools-mcp-workbench\\scripts\\start-workbench.ps1",
        "-Workspace",
        "C:\\path\\to\\your\\repo"
      ]
    }
  }
}

Then ask your client: "run the test suite and fix the first failure."

Prefer HTTP? Drop --stdio and the server speaks Streamable HTTP on http://127.0.0.1:8765/mcp (MCP 2025-11-25, with 2025-06-18 compatibility). A one-line installer, per-client walkthroughs, and troubleshooting live in docs/quickstart.md and docs/mcp-client-config.md.

Seven things to try

1. Make Claude Desktop your coding agent. The config above is all it takes — the chat window you already pay for can now read, patch, test, and commit-review a real repository.

2. Code on your own machine from anywhere.

CODING_TOOLS_MCP_AUTH_MODE=bearer ./scripts/tunnel.sh cloudflared /path/to/repo

Loopback bind + authenticated HTTPS tunnel (cloudflared, ngrok, or Microsoft Dev Tunnel). Point claude.ai on your phone at https://<tunnel-host>/mcp and drive your home workstation from anywhere. Bearer tokens and OAuth 2.1 + PKCE (with RFC 7591 dynamic registration) are built in. → docs/remote-mcp.md

3. Let an agent loose on untrusted code — inside a disposable sandbox.

docker build -t coding-tools-mcp-sandbox:local .
docker run --rm --init -it -p 8765:8765 -v "$PWD:/workspace" coding-tools-mcp-sandbox:local

A containerized server with toolchains and caches preconfigured, safe to point at a sketchy PR and destroy afterwards. → docs/docker.md

4. Spin up a cloud sandbox with one MCP call. The bundled Cloudflare Worker control plane exposes start_coding_tools_sandbox as an MCP tool: one call dispatches a GitHub Actions runner that boots the Docker sandbox and publishes it behind an authenticated Cloudflare Tunnel. Ephemeral compute, no server of your own.

5. Drive it from a GUI.

python -m pip install "coding-tools-mcp[desktop]"
coding-tools-mcp-desktop

Per-workspace profiles, server and tunnel start/stop, credential setup with clipboard helpers, live health checks. English and Simplified Chinese.

6. Keep an interactive session alive. exec_command starts a REPL or debugger under a real PTY; write_stdin feeds it across turns; read_output pages long output; kill_session cleans up. Long-running processes are first-class, with deadline watchdogs and bounded buffers.

7. Give your own agent production-grade hands. Building an agent loop with the Anthropic SDK or anything else? Don't hand-roll file and exec tools — speak MCP to this server and inherit the whole safety boundary. → docs/embedding.md

The tool catalog

One truthfully annotated runtime catalog. Optional capability groups can be hidden when their reviewed dependency/configuration is absent; the catalog is stable for the lifetime of one server. apply_patch is the sole direct workspace file-mutation primitive: staged, baseline-checked, atomic across files, with rollback.

Root AGENTS.md/CLAUDE.md files load into the initialize context automatically. Tool content is concise agent-facing text; structuredContent carries the complete machine result. Schemas and result envelopes: docs/tools-and-schemas.md · docs/runtime-contract-v0.2.md.

Safety Boundary

Recursive listing and search exclude .git, node_modules, build outputs, virtualenvs, and caches. Commands run with workspace-bound cwd, scrubbed environment, timeouts, and output caps. Linux hosts with Landlock get kernel-enforced filesystem confinement; other platforms get an explicit warning — this is still not a complete OS sandbox, so use the Docker image or a VM for genuinely untrusted work. Details: SECURITY.md · docs/security-boundary.md · docs/permission-modes.md

Telemetry

Telemetry is off by default in this downstream branch. The implementation can be enabled only by explicitly setting telemetry to on and supplying an operator-owned HTTPS endpoint and write-only ingest key. DO_NOT_TRACK=1 and CI still force it off; CODING_TOOLS_MCP_TELEMETRY=debug prints events to stderr without sending. The closed event schema and guarantees are documented in docs/telemetry.md.

Evidence, Dogfood and SWE-bench

Every release ships through a tag-triggered pipeline in which the compliance suite, real-workload benchmark, and SWE-bench harness run from the same commit that publishes to PyPI and npm — both via trusted publishing, npm with provenance. Dogfood efficiency metrics are reproducible (make dogfood-smoke) and checked in under reports/. This repository does not claim a model-generated SWE-bench leaderboard result — see docs/swe-bench.md for exactly what is and is not measured. More: COMPLIANCE.md · BENCHMARK.md · docs/dogfood.md

Documentation

Development

python -m pip install -e ".[dev]"
make ci        # lint, typecheck, tests, protocol/integration suites, gates

The full gate matrix is in docs/ci-and-tests.md.

License

This project is licensed under the Apache License 2.0.

If you use code, documentation, substantial implementation details, or derivative work from this project, preserve the copyright notice, license notice, and NOTICE file, and clearly attribute the original project.

This downstream branch is based on xyTom/coding-tools-mcp and retains that project's history and Apache-2.0 obligations. See docs/LINEAGE_AND_INFLUENCES.md for a separation of direct code lineage, API integrations and design prior art.

Project: Coding Tools MCP
Author: Coding Tools MCP Contributors
Downstream source: https://github.com/biaobiao2233/coding-tools-mcp-workbench

Upstream source: https://github.com/xyTom/coding-tools-mcp

Citation metadata is available in CITATION.cff.