Skip to main content
Glama
jmars

rattan

by jmars
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

Rattan

An MCP server that runs commands inside an Arch Linux sandbox: seccomp (pledge-style) + user namespaces + bubblewrap + Landlock + overlayfs. Agent changes are discarded unless you call env_commit.

Implemented: host capability probe, a C stage3 inner binary (no_new_privs → Landlock → seccomp), a bootstrapped Arch rootfs with pacman, content-addressed overlay commits, and 18 MCP tools.

┌───────────────┐   stdio    ┌────────────────────────────────────────────┐
│  MCP client   │ ◀────────▶ │  rattan server (Python, trusted, unpledged) │
│  (agent/LLM)  │            └────────────────────────────────────────────┘
                                      │
                              bwrap + overlayfs
                                      │
                 ┌────────────────────┼─────────────────────┐
                 ▼                    ▼                     ▼
        ┌────────────────┐   ┌────────────────┐   ┌──────────────────┐
        │ base rootfs    │   │ committed      │   │ session upperdir │
        │ (read-only)    │   │ layers (COW)   │   │ (writable,       │
        │                │   │                │   │  discard default)│
        └────────────────┘   └────────────────┘   └──────────────────┘
                            ┌───────────────────────────────┐
                            │  /init = stage3 (C binary)     │
                            │  no_new_privs → Landlock →     │
                            │  seccomp → execvp(user cmd)    │
                            └───────────────────────────────┘

Security

Layers, outermost to innermost:

  • user namespaces — commands run as unprivileged uid/gid 1000

  • bubblewrap --unshare-all — separate mount/PID/IPC/UTS/network namespaces; network denied in agent mode

  • overlayfs COW — read-only base rootfs + committed layers; writes land in a session-only upperdir

  • stage3 (/init) — applies no_new_privs, Landlock, rlimits, seccomp before execvp

stage3 denies keyctl, add_key, request_key, ptrace (unless gdb), unshare, setns, mount, pivot_root, umount2, reboot.

It's a containment tool, not a malware sandbox: the host kernel and host tools are trusted. Network is only available to pacman_install (provisioning). Redirects (>, >>, <, 2>, 2>&1) are applied, with targets confined to /workspace and /tmp.

Enforceable invariants, each with a test: docs/security-invariants.md.

Related MCP server: Containarium-Cloud

Requirements

  • Linux ≥ 6.2, unprivileged userns enabled, Landlock active, bubblewrap, overlayfs

  • Python ≥ 3.10

make verify checks all of it.

Build

git clone https://github.com/jmars/rattan.git && cd rattan
python3 -m venv .venv && .venv/bin/pip install -e .
make stage3            # needs cosmocc + assimilate on PATH
make bootstrap-rootfs  # base Arch rootfs → ~/.local/share/rattan/rootfs/base
make verify

Run

rattan --probe   # host capability check
rattan           # MCP server over stdio

MCP client config:

{ "mcpServers": { "rattan": {
  "command": "/path/to/rattan/.venv/bin/rattan",
  "args": []
}}}

Tools (18)

  • command execution: shell_run, shell_list

  • environment: env_status, env_reset/env_discard, env_commit, env_snapshot_list, env_rollback, env_gc

  • packages: pacman_install, pacman_run

  • background jobs: shell_job_start, shell_job_status, shell_job_wait, shell_job_output, shell_job_kill, shell_job_list

  • host access: bind_host_dir

Examples

shell_run(command="uname -a", structured=False)
# "Linux rattan ... GNU/Linux"

pacman_install(packages=["tree"])   # network
shell_run(command="tree /workspace")
env_discard()                        # tree is gone again

env_commit(message="added tree")     # → {commit_id, ...}
env_snapshot_list()
env_rollback(to_commit_id="...")
env_gc()

pacman_run(args=["-Q", "tree"])      # read-only, no network

shell_job_start(command="make -j4", cwd="/workspace")
shell_job_wait(job_id=1)

bind_host_dir(host_path="/home/me/data", mount_point="/mnt/data", mode="ro")

bind_host_dir rejects /, $HOME, /etc, /proc, /sys, and the rattan data dir.

Verify

make verify   # host gate: capability probe, bwrap, stage3, overlay, shell_run
make test     # 187 tests

Docs

docs/architecture.md · docs/implementation-plan.md · docs/security-invariants.md · docs/bootstrap.md

This server cannot be installed

F
license - not found
-
quality - not tested
B
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

View all related MCP servers

Related MCP Connectors

  • ArcAgent MCP

    ArcAgent MCP server for bounty discovery, workspace execution, and verified coding submissions.

  • Arcjet

    An MCP server for Arcjet - the runtime security platform that ships with your AI code.

  • neverinfamous-memory-journal-mcp

    A MCP server built for developers enabling Git based project management with project and personal…

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jmars/rattan'

If you have feedback or need assistance with the MCP directory API, please join our Discord server