SkyXtools-Mcp — Manual Listener

Python-only implementation following the same connection pattern used by HexStrike AI:

OpenCode
  └─ skyxtools_mcp.py (MCP stdio bridge; OpenCode starts this)
       └─ HTTP requests to http://127.0.0.1:8888
            └─ skyxtools_server.py (listener; you start this manually)
                 └─ local security tools

The listener is a local REST service, not a remote MCP endpoint. This keeps the long-running strategy state, evidence, and tool processes separate from OpenCode.

Install

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
nano .env

Set authorized scope:

SKY_SCOPE=example.com,*.example.com

Or use:

./scripts/install.sh

1. Start listener manually

Keep this terminal open:

source .venv/bin/activate
set -a; source .env; set +a
python3 skyxtools_server.py

Custom port or debug:

python3 skyxtools_server.py --port 8888 --debug

Verify:

curl http://127.0.0.1:8888/health

Expected:

{"status":"healthy","service":"SkyXtools-Mcp","mode":"manual-listener"}

2. Configure OpenCode bridge

Copy opencode.example.jsonc into your OpenCode configuration and replace /ABSOLUTE/PATH/SkyXtools-Mcp with the actual repository path.

Example:

{
  "mcp": {
    "skyxtools-mcp": {
      "type": "local",
      "command": "/home/kali/SkyXtools-Mcp/.venv/bin/python",
      "args": [
        "/home/kali/SkyXtools-Mcp/skyxtools_mcp.py",
        "--server",
        "http://127.0.0.1:8888"
      ],
      "enabled": true,
      "timeout": 300000
    }
  }
}

OpenCode starts only the lightweight stdio bridge. The HTTP listener must already be running.

Check

opencode mcp list

Inside OpenCode, call listener_health before other tools.

Stop listener

Return to the listener terminal and press:

Ctrl+C

Components

• skyxtools_server.py — manually started Flask listener.

• skyxtools_mcp.py — FastMCP stdio bridge used by OpenCode.

• skyxtools_core.py — scope guard, adapters, evidence, and strategy engine.

• .opencode/skills/.../SKILL.md — OpenCode strategy skill.

The listener refuses non-loopback bind addresses. Do not expose port 8888 publicly.