apply_patch being the sole way to change a file means edits are staged, baseline-checked and atomic across files, so a half-applied change is not a state you can end up in. And because permission modes change command policy rather than the tool list, the model always sees the same catalog — no profile switching that quietly alters what it thinks it can do. On Linux the confinement is kernel-enforced; elsewhere use the Docker image for genuinely untrusted work.
A model-neutral coding runtime served over MCP: file reading and search, structured multi-file patches, command execution, interactive sessions and git, confined to a single workspace root.
- Files and search — read_file, list_dir, list_files, search_text, view_image, and apply_patch as the only file-mutation primitive: staged, baseline-checked, atomic across files, with rollback
- Execution — exec_command under a real PTY, write_stdin to feed a running REPL or debugger across turns, read_output to page long output, kill_command to clean up, and request_permissions
- Git — git_status, git_diff, git_log, git_show and git_blame
- Runtime — server_info and check_exec_environment
- 18 tools in a fixed catalog; permission modes change command policy, never which tools the model sees
- Three modes: safe by default, where network-looking commands, shell expansion, inline scripts and destructive commands need explicit permission; trusted for local development; dangerous for isolated containers only
- AGENTS.md and CLAUDE.md at the root load automatically and come back in the initialize instructions
- A Docker image, and a remote path with bearer tokens or OAuth 2.1 with PKCE for driving your workstation from elsewhere
Python 3.11 or above from PyPI; the npm package is a thin launcher that starts it through uv or pipx. Run uvx coding-tools-mcp --stdio --workspace with your repo path, or npx for the Node toolchain; drop --stdio and it speaks Streamable HTTP on http://127.0.0.1:8765/mcp. Absolute paths, .. traversal and symlink escapes are rejected. On Linux, Landlock adds kernel-level filesystem confinement; other platforms get a warning instead.
One command — uvx coding-tools-mcp --stdio --workspace /path/to/repo