Return identity information for the real host running this MCP server.

Get a compact summary of the real host: identity, uptime, disk and memory.

Run a shell command on the real host as the current desktop user.

Bash (/bin/bash -lc) on Linux/macOS, PowerShell on Windows. The server blocks privilege escalation and several obviously destructive system commands. Note: deletion via shell (rm / Remove-Item) is NOT blocked and does NOT prompt; use file_delete for guarded deletes that request approval.

Read a text file from an allowed host path.

Default readable roots are the home directory plus /etc and /var/log on Linux/macOS. Configure HOST_MCP_READ_ROOTS to change them.

Write a text file inside an allowed writable host root.

Existing files are not replaced unless overwrite=true. Default writable root is the user's home directory. Configure HOST_MCP_WRITE_ROOTS to change it.

List an allowed directory on the real host.

Return size, modification time and type for a file on the host.

Recursively find files whose name matches a glob pattern (e.g. *.log).

Recursively search file contents for a regex pattern. Prefers ripgrep, falls back to grep or pure Python.

Copy a file or directory. Source must be readable, destination must be writable.

Move or rename a file or directory inside writable roots.

Delete a file, or a directory when recursive=true. Never deletes a configured root itself.

List host processes (ps sorted by CPU on Linux/macOS, tasklist on Windows), optionally filtered by a substring.

Send a signal to a host process. PID 1 and the MCP server itself are protected.

Show status of a user-scope service: systemd --user on Linux, launchctl on macOS, sc query on Windows.

Show filesystem usage (df on Linux/macOS, drive usage on Windows) plus size of one allowed path.

Show git status and current branch for a repository on the host.

Show recent commits for a repository on the host.

Show uncommitted changes (or staged changes with staged=true) for a repository.

List local and remote branches for a repository on the host.

Stage all changes and commit in a repository inside writable roots. Never pushes.

Fetch an http(s) URL from the host and return its text. Response size is capped.

Test whether a TCP port on a host is reachable from this machine.

Download an http(s) URL to a file inside writable roots. Total size is capped.

Start a persistent shell session (or run a command interactively).

Empty command spawns a login shell kept alive across calls. Use terminal_write to send input, terminal_read for incremental output, terminal_wait to block for a pattern/exit instead of polling.

Read new output from a terminal session since cursor. Returns new cursor.

Send keystrokes/commands to a terminal session's stdin.

Store terminal dimensions (metadata; no PTY ioctl yet).

Send INT/TERM/KILL (HUP on Unix) to a terminal session.

Block until regex pattern appears in new output, process exits, or timeout.

Terminate a terminal session and release it.

List live terminal sessions with pid, cwd, age and buffer size.

Launch a command in background. Returns job_id; page with job_output, block with job_wait.

Show state, pid, exit code and buffer sizes for a job.

Read new job output since cursor. Returns new cursor.

Block until a job exits or timeout. Prefer over polling job_status.

Terminate a running job (TERM, then KILL after 5s).

List background jobs, optionally only running ones.

Return the last N mutating-tool audit records (paths and sizes only, never contents).

Filter audit trail by tool name substring and ok true/false/any.

Replace an exact string in a file. dry_run=true previews a unified diff without writing.

Apply a unified diff to a file (patch binary preferred, naive fallback otherwise).

Return the first N lines of a file.

Return the last N lines of a file.

Render an ASCII tree of a directory (noise dirs hidden).

Find files by glob, fd preferred with find/pathlib fallback.

Search contents: literal by default, regex=true for patterns. rg preferred.

Subsequence filename search ranked by match compactness.

Show a commit with stat (oneline). Read-only.

Blame line ranges of a tracked file. Read-only.

List/create/delete tags. list is read-only; create/delete prompt.

Stash list/push/pop/drop. pop/drop are destructive.

Checkout branch (create with -b). Refuses on dirty tree.

Reset modes; --hard requires confirm=true.

Revert a commit by creating an inverse commit.

Merge a branch into the current one.

Rebase onto upstream; abort/continue conflicted rebases.

Preview (dry_run) or execute clean; execution requires confirm=true.

Create an isolated worktree under .worktrees/ for agent work.

List worktrees of a repository. Read-only.

Remove an agent worktree created by git_worktree_create.

Point-in-time cpu/memory/disk/load/temps/battery/gpu/network/uptime.

User journal tail, optional service/priority/since filter.

Listening sockets with owner pid/process (/proc on Linux, ss/lsof fallback).

TCP connect to host:port with latency.

Which process owns a listening port (pid, comm, cmdline, cwd).

List containers (running by default, all=true for all).

Tail logs of a container.

State, image, ports and mounts of a container.

Start a container.

Stop a container (10s timeout).

Restart a container (10s timeout).

Remove a (stopped) container.

Run sh -c inside a container. --privileged blocked.

Search native package manager (apt/dnf/pacman/brew/...).

Show package metadata from native manager.

Install a package (apt/dnf/pacman/brew). Developer/full profile only.

Remove a package. Developer/full profile only.

Refresh package index (apt-get update / brew update / ...).

Resolve a hostname to addresses.

Network interfaces with state and MAC.

Active TCP/UDP sockets via ss or netstat.

Layered diagnosis: host:port/http(s):// (DNS/TCP/owner/HTTP/resources) or service:NAME.

Copy a file/dir into a timestamped slot before risky ops.

List snapshot slots with source and creation time.

Copy a slot back. Prompts (destructive); overwrite required on clash.

One-call pre-edit snapshot of a single file.

Restore the newest snapshot recorded for this path.

Current time in an IANA timezone (default local).

Convert ISO datetime between IANA timezones.

List IANA zones, optionally filtered.

Store one observation on an entity (persistent knowledge graph).

Link two entities with a typed relation.

Substring recall over entities, observations and relations.

Delete an observation or whole entity. Prompts.

Record one reasoning step in a sequential chain.

Return the current thought chain.

Clear the thought chain. Prompts.

Fetch URL, strip boilerplate, return LLM-ready text (<=3 redirects).

Keyless-first search: auto fans out to html+wiki+duck; brave when keyed.

Dedicated Wikipedia search. Keyless, reputable, structured.

Keyless DB probe: sqlite files, postgres/redis reachability.

Render JS page in headless Chrome, return DOM text. Opt-in.

Screenshot page to PNG in writable roots. Opt-in; prompts.

Repo metadata (needs GITHUB_TOKEN).

List/get/create issues. create prompts.

List/get/create PRs. create prompts.

SELECT-first SQL (postgres psql / sqlite stdlib). Writes need confirm+full.

List tables for a DSN.

GET a redis key (needs REDIS_URL or url=).

Forward geocode (google with key, else nominatim).

Directions (google with key, else straight-line km).

List rclone remote path (needs RCLONE_REMOTE).

Copy remote file into writable roots. Prompts.

List channels (needs SLACK_BOT_TOKEN).

Post a message. Prompts.

Gateway health + version. No key needed.

List routable combos + provider models.

Combos with member models (sina-pro, image, FastImg...).

Provider health, no secrets.

Requests, tokens, cost, provider list.

Ask any combo/model. Single-shot completion with usage.

SSE chat; returns concatenated text.

Same prompt to N models in parallel (max 6). Judge/ensemble primitive.

Generate images (b64_json). Default auto-picks FastImg member.

Text-to-speech. Shape varies by host.

Speech-to-text from base64 audio.

Embed texts. Shape varies by host.

Web search through 9router's connection. Keyless for you.

Video generation. Speculative on this host; kept for others.

Linked providers with source + live status. Never returns secrets.

Start linking github|vercel|cloudflare. Returns open-link + request_id (or already:true).

Block until the user authorizes (link opened) or timeout. Polls 5s.

Validate a pasted token live, store chmod 600, close request.

Delete a stored token. Prompts. CLI logins untouched.

List Vercel projects. Auto token (env > stored > CLI login).

List deployments, optional project name/id filter.

Deployment detail: aliases, state, regions, creator.

Build/runtime event tail for a deployment.

Rebuild a deployment. Prompts (creates live deploys).

List zones (id, name, status, plan). Needs token.

First account id/name. Needs Account:Read.

List DNS records for a zone (name or id).

Create a DNS record. Prompts.

Delete a DNS record by id. Prompts.

Purge a zone cache. Prompts.