Outpost

Outpost is a self-hosted Model Context Protocol server that puts a shell on the machine it runs on. It ships a single tool, exec, that lets an AI agent run real commands and read the real output — PowerShell on Windows, Bash on Linux and macOS.

It is deliberately small: a handful of tools, one binary, one port.

Why Outpost

Most AI agents can talk to a codebase but not to the machine around it. Outpost closes that gap: point any MCP client at it and the agent gains shell access — check disk usage, tail a log, restart a service, build a project.

• One tool, no framework. exec takes a command and returns its output. Nothing else to learn.

• Runs where you do. The same binary on Windows, Linux and macOS, using the native shell of each.

• Self-hosted. The server runs on your hardware. Your commands never leave the box.

• Ships as a single file. One compiled executable, no runtime to install on the target machine.

Related MCP server: MachineBridge Unified Server

The exec tool

The tool returns the combined stdout and stderr plus the exit code, and flags a non-zero exit as an error. Output longer than 100 000 characters is truncated.

// tools/call
{
  "name": "exec",
  "arguments": {
    "command": "git status --short",
    "cwd": "/home/user/project",
    "timeout": 10000
  }
}

The shell is chosen automatically from the host platform:

Quick start

Requires Bun.

bun install
bun run start

The server listens on port 65432 and speaks the Streamable HTTP transport. Reach it at http://localhost:65432/mcp, point any MCP client at that URL, and the exec tool shows up in the tool list.

Connect a client

{
  "mcpServers": {
    "outpost": {
      "type": "http",
      "url": "http://localhost:65432/mcp"
    }
  }
}

Build a standalone binary

bun run build

This produces a single self-contained executable — outpost on Linux and macOS, outpost.exe on Windows — that runs the server without Bun installed. Copy it to any machine and start it.

To build for a specific platform from any host, use the build:target script:

TARGET=bun-darwin-arm64 OUTFILE=outpost-macos-arm64 bun run build:target

Download a prebuilt binary

Every tagged release ships standalone builds for Windows, Linux and macOS — no runtime required:

Grab them from the releases page. macOS binaries are unsigned, so Gatekeeper may block the first launch — run xattr -d com.apple.quarantine outpost once, or right-click the app and choose Open.

Expose it to an online LLM

Outpost runs on your machine, so a hosted model cannot reach it on its own. Put a tunnel in front of the server to publish the endpoint on the public internet, then give your client the tunnel URL.

With localtunnel

localtunnel needs no account and no install:

bunx concurrently 'bun run start' 'bunx localtunnel --port 65432'

concurrently runs the server and the tunnel side by side and stops them together. The tunnel prints the public URL it assigned you:

your url is: https://cool-lions-sing.loca.lt

The MCP endpoint is that URL with /mcp appended:

{
  "mcpServers": {
    "outpost": {
      "type": "http",
      "url": "https://cool-lions-sing.loca.lt/mcp"
    }
  }
}

With cloudflared

cloudflared gives you a quick tunnel with a random domain, also without an account:

bunx concurrently 'bun run start' 'cloudflared tunnel --url http://localhost:65432'

Or, if cloudflared is already installed:

cloudflared tunnel --url http://localhost:65432

It prints something like:

https://quiet-broken-fox.trycloudflare.com

Again, the MCP endpoint is that URL plus /mcp.

⚠️ You are publishing a shell

A tunnel makes the endpoint reachable by anyone who has the URL, and every command it accepts runs with the server's privileges. Before pointing a hosted model at it:

• Treat the tunnel URL as a password. It lands in your shell history and in the logs of whatever you paste it into.

• Do not leave the tunnel running unattended — close it when you are done.

• Prefer a short-lived tunnel over a permanent one, and a model you trust over a URL you forgot about.

• localtunnel may answer browser-like visitors with a consent page asking for the tunnel password. Programmatic clients are served directly, but cloudflared is the smoother option for API traffic.

• Authentication is on the roadmap but not in this release — until it lands, the tunnel URL is your access control.

Logging & audit trail

Every command is recorded, so you can always answer who ran what, and when.

Each entry goes to outpost.log as JSON Lines, and to the console in a readable form:

[2026-10-20T16:17:51.694Z] exec actor=Claude (Anthropic) ip=160.79.104.10 command=git status exitCode=0 durationMs=394

{
  "ts": "2026-10-20T16:17:51.694Z",
  "event": "exec",
  "actor": "Claude (Anthropic)",
  "ip": "160.79.104.10",
  "command": "git status",
  "cwd": "/srv/app",
  "exitCode": 0,
  "timedOut": false,
  "durationMs": 394
}

The actor is resolved from the caller's IP address:

Anthropic publishes its ranges (source). xAI does not publish any, so the Grok entries are the edge addresses api.x.ai currently resolves to — that match is best effort by nature.

Set OUTPOST_LOG to change the log file, or to off to keep everything on the console:

OUTPOST_LOG=/var/log/outpost.log bun run start

The caller's address is taken from the usual proxy headers (cf-connecting-ip, x-forwarded-for, …) when the server runs behind a tunnel, and from the socket otherwise. A client talking to the server directly can set those headers itself, so treat the actor as a hint unless the endpoint sits behind a proxy that overwrites them.

Security

Outpost hands out shell access. Treat the server as a remote shell.

• It listens on port 65432 on every network interface, so anything that can route to your machine can reach it. Keep the machine on a trusted network, or bind it to a single interface.

• Anyone who can reach the endpoint can run any command with the server's privileges.

• A tunnel publishes that endpoint to the internet — read the warnings above before you set one up.

• Authentication and per-command allowlists are planned, but not in this release.

Roadmap

Outpost is early and more versions are coming. Planned for the next releases:

• More tools beyond exec — file read/write, search, process and service management.

• Authentication and per-tool permissions.

• Command allowlists, denylists and working-directory scoping.

• Streaming output for long-running commands.

• A stdio transport for local editor and agent integrations.

• Packaged releases for Windows, Linux and macOS.

Want to steer the roadmap? Open an issue.

Contributing

Issues and pull requests are welcome. Run the checks before you push:

bun run typecheck
bun run format

Star this repo

If Outpost is useful to you — or if you want to follow its development — please give it a star. It costs nothing, it is the single best way to support the project, and it helps other people find it.

⭐ Star georgesnoe/outpost

License

MIT © 2026 Kossi Georges-Noé AHOMBO