CliSeat MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@CliSeat MCPclaim the cli seat for my session and show me the latest handover notes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
CliSeat MCP (Lite Edition)
CliSeat MCP is a role-based seat dispatch, session handover ledger, and terminal command governance plane designed for autonomous AI coding agents (Claude Desktop, Cursor, OpenAI Codex, Roo-Code, AutoGen).
It guarantees single-writer mutual exclusion across CLI environments, manages session handover briefs to prevent context loss across agent shifts, and enforces domain command boundaries to eliminate destructive out-of-domain actions.
π― The Problem
When multiple autonomous agents or human-agent teams operate in software repositories:
Concurrency Collisions: Two agent sessions try to run builds, edit files, or commit git branches at the same time without mutual exclusion (seat locks).
Session Handover Amnesia: When an agent session ends or hits context limits, the incoming successor agent starts blindβunaware of pending tasks, uncommitted files, or recent terminal outputs.
Out-of-Domain Execution: An agent scoped for frontend build tooling runs destructive infrastructure or database commands without boundary enforcement.
CliSeat provides a lightweight governance plane directly over standard MCP stdio.
Related MCP server: BranchLock MCP
β¨ Features (Lite Edition)
π Role-Based Single-Writer Seats: Mutual-exclusion seat locks (
claim_seat,release_seat) per domain (e.g.domain:cli,domain:db).π Structured Handover Briefs: Mandatory sign-off notes ensure incoming agent sessions inherit full state and priorities.
π‘οΈ Domain Boundary Validator: Whitelists approved commands per domain to block out-of-domain command execution.
β‘ Zero-Dependency Core: Pure Python runtime with zero database setup required.
π Quickstart
1. Installation
git clone https://github.com/johannschiffer/cliseat-mcp.git
cd cliseat-mcp
pip install -e .2. Configure in Claude Desktop or Cursor
Add to your claude_desktop_config.json:
{
"mcpServers": {
"cliseat": {
"command": "cliseat",
"args": ["run"]
}
}
}3. CLI Inspection
cliseat statusπ οΈ MCP Tools Reference
Tool | Parameters | Description |
|
| Claims exclusive execution seat |
|
| Releases seat and records handover notes |
|
| Returns seat occupancy, holder, and latest handover brief |
|
| Runs command validated against domain boundary whitelist |
| (none) | Lists all configured seats and their statuses |
π Upgrade to CliSeat Pro
Need persistent cryptographic handover ledgers, automated lease heartbeats, and token redaction?
The CliSeat Pro Edition adds:
π Cryptographic Handover Ledger (SQLite WAL): Immutable sign-off ledger storing SHA-256 state hashes, command history, and uncommitted git snapshots.
π Atomic Lease Heartbeat & Anti-Zombie Reaper: Auto-reclaims seats abandoned by disconnected or crashed agent sessions.
π‘οΈ Command Scope Policy & Output Redactor: Automatically masks authentication tokens, passwords, and private keys from stdout/stderr.
π³ Production Docker & Docker Compose manifests.
π§ͺ 100% Passing Pytest Suite.
π Get CliSeat Pro on Gumroad ($14.99 USD)
π License
MIT Β© 2026 Johann Schiffer
Available Tools
5 toolsclaim_seatB
Acquire exclusive single-writer execution seat for a domain (e.g. 'domain:cli', 'domain:db').
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | Permission domain boundary (default: 'domain:cli'). | |
| seat_id | Yes | Target seat identifier (e.g. 'domain:cli'). | |
| lease_ttl_sec | No | Lease duration in seconds before auto-expiration (default: 300). | |
| holder_session_id | Yes | Agent session ID claiming the seat. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses the exclusive single-writer nature of the seat, but omits critical behavior for a lock-acquisition tool: what happens if the seat is already held, whether acquisition blocks or fails, auth requirements, and lease renewal/release semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It efficiently communicates the core action and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The purpose is adequately stated and the schema fully documents parameters, but with no annotations and no output schema, the description could do more to explain acquisition semantics such as conflict handling and lease behavior. It is minimally viable but leaves notable behavioral gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented in the input schema. The description adds no additional meaning about parameter formats or constraints beyond the examples already present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Acquire'), resource ('execution seat'), and key scope ('exclusive single-writer', domain examples). It is clear what the tool does, but it does not explicitly differentiate itself from siblings such as release_seat or execute_domain_command.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance about when to use this tool versus alternatives like release_seat or execute_domain_command. The purpose implies claiming a seat before execution, but no conditions, prerequisites, or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_domain_commandC
Execute terminal command validated against seat domain boundary permissions.
| Name | Required | Description | Default |
|---|---|---|---|
| seat_id | Yes | Authorized seat ID. | |
| command_line | Yes | Command string to run (e.g. 'git status'). | |
| holder_session_id | Yes | Session holding the seat. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that a permission validation gate exists, which is genuinely useful, but says nothing about what happens on rejection, whether execution is sandboxed or destructive, timeout limits, or side effects. For a terminal-command execution tool this is a serious transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, and the permission constraint is placed where it matters. It is appropriately terse for such a short field set, though the brevity borders on under-specification for an execution tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a command-execution tool with no annotations and no output schema, the description should explain safety profile, failure behavior, and return shape. None of that is present, leaving an agent unable to predict the consequences of invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (seat_id, command_line, holder_session_id) are already documented in the schema. The description adds no parameter-level meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Execute) and resource (terminal command) plus a scoping constraint (validated against seat domain boundary permissions). The seat-lifecycle siblings (claim_seat, release_seat, get_seat_status, list_seats) are distinct enough that an agent can route here without confusion, though the description never names or contrasts them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no statement of prerequisites (e.g. must a seat be claimed first via claim_seat?), and no indication of which commands are permitted or rejected. The only implicit signal is the 'seat domain boundary permissions' phrase, which hints at validation but is not operational guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_seat_statusA
Check occupancy, current holder session, remaining lease, and handover brief of a seat.
| Name | Required | Description | Default |
|---|---|---|---|
| seat_id | Yes | Seat identifier (e.g. 'domain:cli'). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the returned facets (occupancy, holder session, lease, handover brief), which implies a side-effect-free read, but says nothing about authorization needs, behavior for an unknown/expired seat, or whether the lease/handover fields can be null.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the verb and resource, that packs in the four returned facets without a wasted word.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, enumerating the returned fields in the description is exactly the right compensation. Only minor gaps remain (error/empty-seat behavior), so it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter and schema description coverage is 100%, with the schema documenting seat_id including an example ('domain:cli'). The description adds no extra meaning about the identifier's format or scope, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (Check) plus resource (seat) and an explicit enumeration of what is inspected: occupancy, holder session, remaining lease, handover brief. That distinguishes it from the mutating siblings claim_seat/release_seat, though it never names a sibling or contrasts itself with list_seats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The read-only inspection framing implies when this is useful (before claiming or releasing a seat), but there is no explicit when-to-use statement, no exclusion, and no pointer to alternatives such as list_seats for bulk status. Usage is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_seatsB
List all available seats, current statuses, and latest handover briefs.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It implies a read and hints at return content (statuses, handover briefs), but says nothing about read-only guarantees, whether results are filtered or complete, pagination, or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence naming the action first and the returned fields after. No filler, no restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with no output schema and no annotations, the description is adequate but leaves the relationship to get_seat_status undefined and gives no sense of result scope or volume.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. The description correctly implies no input filtering is needed, though it adds nothing about how the result set is scoped.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (List) and resource (seats) plus the payload it returns (statuses, handover briefs). It is clear on its own, but it never distinguishes itself from the sibling get_seat_status, and 'available seats' sits in mild tension with also returning 'current statuses' for all seats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of the obvious alternatives (get_seat_status for a single seat, claim_seat/release_seat for mutations). The agent must infer the routing from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
release_seatB
Release held seat with mandatory handover brief notes for the next agent session.
| Name | Required | Description | Default |
|---|---|---|---|
| seat_id | Yes | Seat identifier to release. | |
| handover_notes | No | Sign-off summary of work completed and pending items. | |
| holder_session_id | Yes | Holding agent session ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that handover notes are treated as mandatory for the next agent session β notable since handover_notes is not in the schema's required list β but it says nothing about permissions, whether the release is reversible, what happens to the seat state, or the failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the action precedes the requirement. Slightly compressed phrasing ('mandatory handover brief notes') but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter mutation tool with no annotations and no output schema, the description covers the core action and the notes requirement but omits the mutation's side effects, authorization expectations, and error behavior. Adequate, but with clear gaps an agent might need to probe.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented in the schema. The description reinforces handover_notes as mandatory and scopes it to 'next agent session', but adds no format or identity semantics beyond that. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (release a held seat) plus an attached requirement (handover notes). This clearly contrasts with the sibling claim_seat, though it never names siblings explicitly. An agent can tell what the tool does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: release a seat you are holding, providing handover notes for the next session. There is no explicit statement of when NOT to use it, no mention of prerequisites (e.g. that you must be the holder) and no reference to alternative tools like get_seat_status or claim_seat.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.0.0- First observed
claim_seat - First observed
execute_domain_command - First observed
get_seat_status - First observed
list_seats - First observed
release_seat
TDQS
Scored across 5 tools
Each tool targets a distinct seat lifecycle action: claim, release, status check, listing, and command execution. There is no meaningful overlap between acquiring a seat and executing commands within it.
All names use consistent snake_case verb_noun patterns (claim_seat, release_seat, get_seat_status, list_seats, execute_domain_command). The verbs are predictable and descriptive.
Five tools is well-scoped for a seat-coordination server, covering the full acquire/use/release lifecycle without extras. Every tool earns its place.
The seat lifecycle is well covered: claim, release with handover, status, list, and bounded command execution. A lease-renewal or heartbeat operation is the only minor gap, but agents can work around it by releasing and re-claiming.
Maintenance
Related MCP Connectors
The team layer for AI coding agents: shared contracts, collision alerts, E2EE sessions.
- AxisOAuthdev.useaxis
Coding agents from Claude Code, Cursor and Codex claim jobs and lock files on one shared board.
- ParleyOAuthdev.weldra
Coordination hub for AI coding agents: message teammates, ask humans, audit every event.
Shared control plane for AI coding agents β tasks, memory, decisions, file locks. 12 tools.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenancePrevents AI coding agents from conflicting by coordinating file claims and resolving conflicts in real-time across multiple sessions.31 npm1MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI coding agents to coordinate exclusive file locks and detect semantic collisions across shared repositories, preventing silent overwrites and merge conflicts.MIT
- AlicenseNot gradedqualityBmaintenanceCoordinates parallel Claude Code agents on shared repositories and orchestrates multiple Claude subscriptions, enabling live session handoff, conflict detection, and remote terminal control.3 npmMIT
- AlicenseAqualityBmaintenanceEnables coding agents to run persistent, budgeted work sessions with dependency graphs, human decision queues, required validation, and clean handoffs for autonomous or human-in-the-loop execution.16MIT