workspace-mcp
Provides a read-only git diff tool that operates within the bounded workspace, allowing users to view changes in Git repositories.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@workspace-mcpsearch for 'TODO' in the src directory"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
workspace-mcp
A small, safety-first local MCP server for one bounded code workspace.
Requires Python 3.10–3.13. Python 3.11 or 3.12 is recommended. The MCP Python SDK does not support Python 3.9, and Python 3.14 is not enabled until the dependency stack is verified there.
Install and run
Use pipx for the CLI application, or a dedicated virtual environment. Do not install into the macOS system/Homebrew environment:
brew install pipx python@3.11
pipx ensurepath
pipx install --python python3.11 ./workspace_mcp-0.3.2-py3-none-any.whlEquivalent virtual-environment installation:
python3.11 -m venv ~/.venvs/workspace-mcp
~/.venvs/workspace-mcp/bin/python -m pip install -U pip
~/.venvs/workspace-mcp/bin/python -m pip install workspace_mcp-0.3.2-py3-none-any.whl
cd /path/to/project
~/.venvs/workspace-mcp/bin/workspace-mcpThe default transport is MCP stdio, so it should be launched by Codex or another MCP client. Running workspace-mcp directly in an interactive terminal prints a ready-to-run codex mcp add command for the current directory and exits instead of waiting indefinitely. For a manual local HTTP test:
workspace-mcp --transport streamable-http --port 8765 --max-port 8865If the requested HTTP port is busy, the server selects the first available port in the configured range. It binds to 127.0.0.1 by default and rejects non-loopback hosts unless --allow-network is explicitly supplied. HTTP mode has no built-in authentication, so do not use --allow-network on an untrusted network.
Related MCP server: chatbottool-mcp
Safety contract
The current directory is the only workspace root by default.
Absolute paths,
..traversal, and symlink escapes are rejected.File reads and writes are UTF-8 and size-limited.
Edits use a line-range replacement with a mandatory SHA-256 optimistic lock.
No arbitrary shell tool is exposed.
git_diffis read-only and runs only in the bounded workspace.
The initial tool set is workspace_root, list_files, read_file, search_text, replace_range, and git_diff. Add a separately reviewed allowlisted run_check tool only if needed.
Platform note
The package and CLI are cross-platform, but v0.3.2 file access intentionally fails closed unless Python exposes secure POSIX dir_fd, O_NOFOLLOW, atomic rename, and flock primitives. A native Windows handle-relative implementation is required before claiming cross-platform file access or editing support.
Available Tools
6 toolsgit_diffA
Return the current Git diff for the workspace.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Return' implies a read-only operation Reports, which is useful, but it does not clarify whether the diff includes staged, unstaged, or untracked changes, nor how repository state affects the result. It is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence communicates the core behavior with no filler. It is appropriately concise for a parameterless tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the zero-parameter schema and presence of an output schema, the description is nearly complete for invocation. The main gap is lack of context about diff scope and repository assumptions, but the low complexity keeps this from being a major deficiency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool accepts zero parameters, and the schema is empty, so there is no parameter detail the description needs to add. The 0-parameter baseline applies here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and resource ('current Git diff') with a clear workspace scope. It is unambiguous and self-differentiates from the file-oriented sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives, when it is appropriate, or any prerequisites such as an initialized Git repository. The description states only what the tool does, not when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesB
List files and directories below the bounded workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | **/* |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full behavioral burden. It states the basic scope but does not disclose that the glob defaults to '**/*' (recursive listing), whether directories are included, how hidden files are handled, or any other operational traits. For a simple read-only tool the bar is lower, but these details are notably absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence conveys the action and scope with no filler. Every word earns its place, and the structure is optimal for an AI agent scanning tool definitions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and an output schema exists, so return values are covered elsewhere. However, the description omits any explanation of the glob parameter and its recursive default, and there is no guidance on when this tool is the appropriate choice among siblings. For a low-complexity tool this is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter, glob, with 0% description coverage, and the tool description does not mention it at all. The agent receives no explanation about pattern syntax, default behavior, or how glob affects the result set. The description adds zero value beyond the schema's bare parameter name and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a clear resource ('files and directories below the bounded workspace'), making the core function unmistakable. It is implicitly distinct from siblings like read_file and search_text, which operate on file content rather than directory structure, so no naming of another tool is necessary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: this is the only sibling that lists workspace contents, so an agent can infer when to invoke it. However, there is no explicit guidance on when to prefer it over other tools or any exclusions, leaving the agent to rely on the tool name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileA
Read a UTF-8 text file using a 1-based inclusive line range.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| end_line | No | ||
| start_line | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It usefully adds non-obvious details like UTF-8 encoding and 1-based inclusive line ranges beyond the schema, but it does not address edge behavior such as what happens when end_line is null, line numbers exceed the file, or how large reads are handled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence that front-loads the core behavior and file format before any optional details. There is no filler and no redundant restatement of schema properties.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read operation with an output schema, the description covers the primary behavior, but it leaves the meaning of end_line=null and out-of-range behavior unspecified, and there are no annotations to fill that gap. It is adequate but not fully self-sufficient for all call variants.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate for parameter meaning, but it only communicates the general line-range concept. It never explains the semantics of end_line defaulting to null, the relationship between start_line and end_line, or how the range behaves when bounds are omitted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation ('read'), a typed resource ('UTF-8 text file'), and the line-range mode, which clearly separates it from sibling tools like list_files, search_text, and replace_range. It is unambiguous and not a mere tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes clear context: use this tool when you need to read the contents of a text file by line range rather than list, search, or modify files. It does not explicitly name sibling alternatives or state when not to use it, so it stops just short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
replace_rangeA
Atomically replace an inclusive line range using a mandatory optimistic-lock hash.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| end_line | Yes | ||
| start_line | Yes | ||
| replacement | Yes | ||
| expected_sha256 | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses atomicity and the mandatory optimistic-lock hash, which are important behavioral traits. However, it does not describe what happens on hash mismatch (e.g., error, no change), permission requirements, or whether the operation is destructive. This is a meaningful gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, information-dense sentence with no filler. The core action and key constraint are front-loaded. Every word contributes meaning, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five required parameters, no annotations, and only a terse description, the tool is under-specified. It lacks parameter semantics, error behavior, and context for the hash requirement. While an output schema exists, it does not mitigate the missing behavioral context. The description is insufficient for an agent to call the tool correctly without further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It maps 'inclusive line range' to start_line/end_line and 'optimistic-lock hash' to expected_sha256, but leaves path and replacement unexplained. The description adds minimal meaning beyond the parameter names themselves, which are self-evident. Given the zero coverage, a higher score is not warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action: 'Atomically replace an inclusive line range' – clear verb, resource, and key constraint (atomicity + optimistic-lock hash). Distinguishes from siblings like read_file, search_text, and git_diff which are read-oriented. The purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Does not explicitly mention alternatives or when not to use. The description implies use for modifying a specific line range, and the mandatory hash implies a prerequisite (must know current file hash), but no explicit exclusions or comparisons to sibling tools are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textB
Search UTF-8 text files within the workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | **/* | |
| query | Yes | ||
| max_results | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool searches UTF-8 text files, which implies it may skip binary files, but it doesn't disclose details like case sensitivity, regex support, or behavior when no matches are found. The description is accurate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose. It's appropriately sized for a straightforward search tool, though it could add a bit more detail without becoming bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema and only 3 parameters, so the description doesn't need to explain return values. However, with no annotations and 0% schema coverage, the description should provide more context about search behavior, glob usage, and result limits. It's adequate but leaves room for improvement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meaning. The description mentions 'text files' and 'workspace' but doesn't explain the query parameter format, glob pattern semantics, or max_results behavior. The parameter names are somewhat self-explanatory, but the description adds little beyond what the schema already shows.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Search') and resource ('UTF-8 text files within the workspace'), which clearly distinguishes it from sibling tools like read_file or list_files. It doesn't explicitly name a sibling alternative, but the scope is clear enough for an agent to understand its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by specifying it searches text files in the workspace, which suggests it's for content-based search rather than file listing or reading. However, it doesn't explicitly state when to use this tool versus alternatives like list_files or read_file, nor does it mention any exclusions or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_rootA
Return the single directory this server can access.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it delivers the key behavioral fact: the server's access is confined to a single directory, which calibrates agent expectations about path scope for all sibling tools. For a zero-parameter getter with no side effects, there is little else to disclose; the read-only nature is strongly implied by 'return'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single eight-word sentence with zero filler. The key information — what is returned and the scope constraint — is front-loaded and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with zero parameters, an output schema, and a description that fully captures its one behavioral constraint, nothing an agent needs to invoke it correctly is missing. There are no edge cases, prerequisites, or failure modes that the description would need to address at this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is an empty object with 100% coverage and 0 parameters, so the baseline is 4. The description's reference to 'the single directory' adds the only meaningful context an agent needs, confirming there is nothing to configure before calling.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('return') tied to a concrete resource ('the single directory') and adds a clear scoping qualifier ('this server can access'). This distinguishes it cleanly from the sibling file-operation tools like list_files, read_file, and git_diff, which operate on paths rather than revealing the access root.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given, and sibling tools are never mentioned. However, usage is reasonably implied: an agent naturally calls this first to learn where the server's filesystem access begins before pointing read_file/list_files at paths. The implication is clear but never stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.3.2- First observed
git_diff - First observed
list_files - First observed
read_file - First observed
replace_range - First observed
search_text - First observed
workspace_root
TDQS
Scored across 6 tools
Each tool targets a distinct operation: workspace info, listing, reading, searching, editing, and diffing. There is no meaningful overlap or ambiguity between any two tools.
Most tools follow a clear verb_noun pattern (list_files, read_file, search_text, replace_range). workspace_root and git_diff are minor deviations but remain readable and do not confuse the overall convention.
Six tools is well-scoped for a workspace file server. Each tool earns its place and there is no redundancy or unnecessary bloat.
The set covers listing, reading, searching, updating, and diffing, but lacks create and delete operations for files or directories. This is a notable gap for a file workspace toolset and will leave some workflows incomplete.
Maintenance
Related MCP Connectors
A MCP server built for developers enabling Git based project management with project and personal…
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceSafe local MCP server for Windows to list, read, search, patch, backup, and verify code files in allowed folders, with Git integration and dry-run diffs.1MIT
- AlicenseNot gradedqualityCmaintenanceA local-first MCP server providing guarded access to a workspace with file operations, search, commands, tests, Git helpers, checkpoints, and structured tool results. It supports multiple tool modes and emphasizes security with workspace restrictions and secret blocking.1MIT
- FlicenseNot gradedqualityCmaintenanceA security-first MCP server that enables clients to inspect and edit multiple local repositories via configured aliases, with read-only Git access and allowlisted test commands.5-
- AlicenseNot gradedqualityBmaintenanceA minimal, security-focused MCP server that provides structured read/write access to exactly one local workspace, with built-in local Git checkpoints and rollback.1Apache 2.0