Loopback

A self-hostable MCP control plane for computers and servers.

Loopback runs on a machine you control and exposes it to MCP-capable clients (agentic IDEs, web agents, your own tooling) as a single authenticated Streamable HTTP endpoint — with a real OAuth 2.1 authorization server, machine-side policy enforcement, an OS-level sandbox where one is available, and an operations dashboard, all in one process. There is no mandatory hosted relay: you choose the ingress (local-only, Tailscale, Cloudflare Tunnel, or your own reverse proxy).

                 MCP client (IDE, web agent, your own code)
                              |
                 HTTPS: local-only / Tailscale / Cloudflare Tunnel
                              |
                 +-------------------------------+
                 |   Loopback  (one process)      |
                 |  OAuth 2.1 AS + MCP resource    |
                 |  server, policy, sandbox,       |
                 |  audit, dashboard                |
                 +-------------------------------+
                   |          |           |
                   v          v           v
              filesystem   shell /     registered
              + documents  jobs /      nodes & SSH
                           terminals    targets (fleet)

Why Loopback?

• Self-hosted by default — no account with a third party is required to operate your own machine through MCP.

• Standards-based auth — OAuth 2.1 authorization code + mandatory PKCE, Dynamic Client Registration and Client ID Metadata Documents, RFC 8707 resource indicators, refresh-token rotation with reuse detection. Scoped, revocable API tokens for bearer-only clients. See docs/AUTHENTICATION.md.

• Machine-side policy, not just client-side trust — filesystem allow/deny roots, per-tool allow/deny, command patterns that require approval or are hard-denied outright, and policy profiles from locked through admin. See docs/PERMISSIONS.md.

• Real OS sandboxing where the platform offers one — Landlock on Linux, bubblewrap as a fallback, Seatbelt on macOS; file tools are always enforced server-side regardless of sandbox availability. See docs/PERMISSIONS.md.

• Real terminal workflows — bounded one-shot execution, background jobs with incremental output, and persistent PTY terminals.

• Fleet-capable — register other Loopback nodes or plain SSH targets and route MCP tool calls to them, each with its own independent policy. See docs/FLEET.md.

• An operations dashboard — topology, fleet, filesystem, shell, jobs, logs, security, backup/recovery and settings, behind its own session auth. See docs/DASHBOARD.md.

• Document tools — structured DOCX, XLSX and PDF read/write helpers instead of shelling out to convert office documents.

• Bundled Agent Skills — ready-to-package skill guidance for coding agents that use Loopback. See docs/SKILLS.md.

A dashboard screenshot lives at docs/images/dashboard-overview.png once you have added one for your own deployment — Loopback ships no binary screenshots by default.

Related MCP server: InstaServer

Install

One-liners (download, verify checksums, install):

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/p5n-n3t/loopback/main/install.sh | bash

# Windows (PowerShell)
irm https://github.com/p5n-n3t/loopback/releases/latest/download/install.ps1 | iex

# Any platform with Node.js 18+
npx loopback-mcp install

From a checkout:

git clone https://github.com/p5n-n3t/loopback.git
cd loopback
./install.sh --non-interactive --ingress local

Full options, service-manager details and platform notes are in docs/INSTALL.md and docs/PLATFORMS.md (Windows specifics: docs/WINDOWS.md).

Once installed:

loopback status       # is it running, on what port/ingress
loopback url          # the MCP endpoint, e.g. https://loopback.example.com/mcp
loopback dashboard --open

MCP tools

Filesystem (read_file, write_file, list_dir, patch_file, search_text, tail_file, git_info), execution (execute, job_*, terminal_*, process_list, process_kill), documents (docx_*, xlsx_*, pdf_*), optional browser and native-desktop automation, system and policy inspection (diagnostics, machine_info, policy_status), and fleet routing (node_list, node_call, node_read_file, node_execute, node_diagnostics). Every tool's MCP scope and annotations are listed in docs/TOOLS.md.

Policy profiles

loopback policy show
loopback policy profile restricted   # default; alias: standard
loopback policy profile admin        # alias: trusted
loopback policy profile read-only
loopback policy profile development
loopback policy profile locked

Profiles set a baseline for filesystem mode, shell/process/fleet access, approval strictness, and whether an OS sandbox is required for shell execution. Full definitions, the default denied roots, and the sandbox backend matrix are in docs/PERMISSIONS.md.

Dashboard

loopback dashboard --open

A vanilla-JS single-page app, served only to authenticated sessions, with a strict Content-Security-Policy (no inline script or style). Covers Overview, Topology, Local machine, Fleet, Filesystem, Shell, MCP tools, Authentication, Cloudflare, Tailscale, SSH config, Jobs, Logs & diagnostics, Security, Backup & recovery, Updates, and Settings, plus a first-run Welcome wizard. See docs/DASHBOARD.md.

Fleet

loopback node add build-server https://build-server.example.com/mcp
loopback ssh add nas alice@nas.example.com --identity ~/.ssh/id_ed25519_loopback

One gateway can route MCP calls to other Loopback nodes or to plain SSH targets; each gets independent policy and never inherits the local machine's allowed roots. See docs/FLEET.md.

Authentication

• OAuth 2.1 clients (agentic IDEs, web agents that support OAuth): discovery via /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, authorization code + PKCE, scoped to loopback:read / loopback:write / loopback:exec / loopback:fleet (never loopback:admin).

• Bearer-only clients: a scoped, revocable API token minted from the dashboard (loopback auth token create ...), not the permanent machine token.

• The machine token is a local bootstrap/recovery credential, rotatable with loopback auth rotate-machine-token.

See docs/AUTHENTICATION.md and, if you are looking for a way to turn a consumer AI subscription's own login session into an API key, docs/OAUTH-TO-BEARER.md for why that specific thing is intentionally not supported.

Ingress and exposure

Local-only (127.0.0.1, nothing exposed), Tailscale (tailnet-only Serve, or public Funnel), or Cloudflare Tunnel (named or token tunnel, with an access policy of OAuth, Cloudflare Access, or both). See docs/TAILSCALE.md, docs/CLOUDFLARE.md and docs/DEPLOYMENT.md.

Agent Plugin / Skills package

python3 scripts/build_plugin.py \
  --mcp-url https://loopback.example.com/mcp \
  --output dist/loopback-plugin.zip

Bundles plugin.json, mcp.json, and the whole skills/ directory (loopback-core, loopback-fleet, loopback-admin, loopback-troubleshooting, loopback-mcp-development). See docs/SKILLS.md and docs/PLUGIN.md.

Documentation

• Install · Upgrade · Migrating from v3 · Recovery

• Configuration · Permissions & sandboxing

• Authentication · OAuth vs. bearer tokens

• Dashboard · Fleet

• Tailscale · Cloudflare · Deployment

• MCP tools · Usage · Web agents

• Agent Skills · Plugin packaging

• Architecture · Admin HTTP API

• Platforms · Windows notes

• Troubleshooting · Benchmarks

• Releasing · Open-source / hosted product boundary

• Security policy · Changelog

Supported platforms

See docs/PLATFORMS.md for the complete matrix and per-distribution installer notes.

License

MIT. See LICENSE.

Independent workers and tunnels

Run HTTP or stdio MCP services on separate Linux workers from the central dashboard, with independent OAuth, Cloudflare or Tailscale exposure, and live process/host telemetry. See Workers and independent MCP services for setup, safeguards and current limitations. The interface adapts the supplied Rackwise Figma kit; the symbol and wordmark use the supplied Loopback layers.