rsync-mcp

The /home/toxic rsync connection as a first-class MCP server. Bun/TypeScript, zero npm dependencies, stdio JSON-RPC — the same house pattern as sovereign/tools/tmux-mcp/server.ts.

Lineage

Fork lineage: jasonlinjc/mcp-ssh-remote (MIT) — the system-rsync + system-ssh wrapping pattern, with ~/.ssh/config inheritance (so host aliases like pc resolve). Rewritten rsync-first for the estate: the connection is parameterized, both ends are sandboxed, and destructive operations are gated. Full upstream history is preserved in this repo; the Bun rewrite lands on top.

Related MCP server: remotessh-mcp

The connection

The estate's established rsync route, as found in shell history (sovereign-recon-20260928):

rsync -avzP -e 'ssh -o ServerAliveInterval=30 -o ConnectTimeout=10' pc:/home/toxic/<path>/ <dest>

All knobs are env config (non-secret — host alias + existing SSH keys only, never credential values):

Tools

Path rules: remote .. segments are refused; local paths must resolve inside RSYNC_LOCAL_ROOT. Output capped at 24KB per call; per-call ceiling 4.5 min (under Gatehouse's 5-min tool timeout).

Run

bun src/server.ts

Gatehouse

Registered as the rsync stdio server in ranch/barn/gatehouse/mcp_config.json (+ durable mcp_config.json.dist):

{
  "name": "rsync",
  "command": "/home/toxic/.bun/bin/bun",
  "args": ["run", "/home/toxic/projects/rsync-mcp/src/server.ts"],
  "env": {
    "RSYNC_HOST": "pc",
    "RSYNC_REMOTE_ROOT": "/home/toxic",
    "RSYNC_LOCAL_ROOT": "/home/toxic"
  },
  "protocol": "stdio",
  "enabled": true,
  "health_check_interval": "15s",
  "tool_discovery_interval": "2m0s",
  "isolation": { "enabled": false, "mode": "none" },
  "quarantined": false
}

Restart Gatehouse through its owned path after config changes:

cd /home/toxic/sovereign && sovereign/bin/pitchfork-restart   # gatehouse daemon only