Skip to main content
Glama
oddoclans-commits

MCP Standalone

by oddoclans-commits
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

MCP Standalone — ChatGPT VPS Tools

Standalone MCP server for ChatGPT (and Claude/Cursor) — exposes VPS tools via OAuth 2.1 + PKCE S256, long-horizon ready with exec_start/poll.

Forked pattern from mso/lib/mcp — no Next.js, no database, just Fastify + ~/.mcp-standalone/mcp.json (sha256 only, atomic 0600).

Features

  • OAuth 2.1 PKCE S256 only (plain rejected), code_verifier 43-128, isAllowedRedirect https-only, timingSafeEqual

  • Discovery: /.well-known/oauth-authorization-server (RFC 8414) + /.well-known/oauth-protected-resource (RFC 9728) + /.well-known/openid-configuration fallback + /.well-known/oauth-protected-resource/mcp variants

  • DCR: POST /oauth/register (RFC 7591) → 201 with client_id, grant_types, etc.

  • Tools (16): fs_list, fs_read, fs_search, fs_usage, sys_stats, sys_processes (read) + fs_write, fs_mkdir, fs_delete, fs_move, fs_copy (write) + exec_run, exec_start, exec_status, exec_output, exec_wait (exec, long-horizon)

  • Long-horizon: exec_start returns <500ms {job_id, pid}, poll exec_status/output/wait until completed — never exec_run for >30s tasks

  • Jail: MCP_FS_READ_ROOTS / WRITE_ROOTS (realpath), denylist ~/.ssh, ~/.mcp-standalone, ~/.mso, etc., catastrophic filter (rm -rf /, fork bomb → 126)

Related MCP server: remote-admin-mcp

Quick Start

cp .env.example .env  # fill MCP_SESSION_SECRET (openssl rand -hex 32), MCP_LOGIN_PASSWORD, etc.
npm install
npm start  # or systemd: mcp-standalone.service → :8790

.env:

PORT=8790
HOST=127.0.0.1
MCP_BASE_URL=https://mcp.brain.biz.id
MCP_SESSION_SECRET=...
MCP_LOGIN_PASSWORD=...
MCP_FS_READ_ROOTS=~:~/projects:~/bridgemind:~/HERMES-OC
MCP_FS_WRITE_ROOTS=~:~/projects:~/bridgemind:~/HERMES-OC
MCP_MAX_SCOPE=exec
OAUTH_CLIENT_ID=chatgpt-mcp-xxxx  # optional, empty = allow DCR any
MCP_STORE=~/.mcp-standalone/mcp.json

Cloudflare Tunnel

# ~/.cloudflared/config.yml
- hostname: mcp.brain.biz.id
  service: http://localhost:8790
cloudflared tunnel route dns gendis-shine mcp.brain.biz.id
sudo systemctl restart cloudflared-tunnel

ChatGPT Connectors

  • MCP Server URL: https://mcp.brain.biz.id/mcp

  • Auth: OAuth → https://mcp.brain.biz.id/oauth/authorize + https://mcp.brain.biz.id/oauth/token

  • Client ID: chatgpt-mcp-... or leave empty for DCR

  • Scope: exec

Verify:

curl https://mcp.brain.biz.id/.well-known/oauth-authorization-server | jq
curl https://mcp.brain.biz.id/health

Systemd

sudo cp mcp-standalone.service /etc/systemd/system/
sudo systemctl enable --now mcp-standalone

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • MCP VPS Manager

    ARMeeru
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs to securely manage Virtual Private Servers via SSH, with features including command execution, file operations, system monitoring, and service management.
    1
    MIT

  • ChatGPT VPS MCP

    yxxrn
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables ChatGPT to securely inspect and administer a Linux VPS over Streamable HTTP, with OAuth protection, workspace file tools, and optional root command execution.
    MIT