#104104th of 128 in MCP servers for developers
coding-tools-mcp
MCP server giving chat clients and agents sandboxed file, patch, exec and git tools
- Stars
- 1.2k
- License
- Apache-2.0
- Last commit
- Oct 2026
- Last release
- Sep 2026
- Language
- Python
0 on 19 May 20261,223 on 10 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Python MCP server that exposes 18 tools (19 in dangerous mode) for reading and searching files, atomic multi-file patches, PTY-backed command execution, and git inspection, confined to one workspace root. Runs over stdio or Streamable HTTP on port 8765 and works with Claude Desktop, Claude Code, Codex, Cursor, Cline, VS Code, Windsurf and Gemini CLI. Permission modes (safe, trusted, dangerous) gate network, shell expansion and destructive commands.
Who it is for: Developers wiring MCP chat clients or custom agents to a local repo safely
Strengths
- Rejects absolute paths, .. traversal and symlink escapes; Landlock confinement on Linux
- Three permission modes, with safe as the default
- Runs via uvx or npx; works over stdio or Streamable HTTP
- Bearer and OAuth 2.1 with PKCE built in for remote tunnel access
Weaknesses
- Not a complete OS sandbox; README says to use Docker or a VM for untrusted code
- Landlock confinement is Linux only; other platforms get a warning
- Anonymous telemetry is on by default and must be disabled by env var
- npm package is only a launcher and still needs Python 3.11+ with uv or pipx
What it needs
- no GPU
- Docker + Compose
- Needs Python >= 3.11, uv or pipx (for the npm launcher), Docker (optional sandbox), cloudflared, ngrok or Dev Tunnel (optional remote access)
- Models: Any MCP client (model-neutral)
- port 8765
What changed
- v0.5.0 ↗ (opens in a new tab)Breaking
“requestpermissions is advertised only in dangerous mode. Outside it”
- v0.3.0 ↗ (opens in a new tab)Breaking
“Breaking: command handles are now named commandid; killsession is”
- v0.3.0rc1 ↗ (opens in a new tab)Breaking
“Breaking: command handles are now named commandid; killsession is”
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in MCP servers for developers
See all 128| Rank | Project | Score |
|---|---|---|
| 1 | gitnexusCode knowledge graph exposed to coding agents through MCP tools | 97 out of 100 |
| 2 | codegraphLocal code knowledge graph that coding agents query over MCP | 95 out of 100 |
| 3 | playwright-mcpMCP server that lets LLMs drive a browser through Playwright accessibility snapshots | 93 out of 100 |
| #4 | code-review-graphLocal Tree-sitter code graph that gives coding assistants review context over MCP | 92 out of 100 |
| #5 | fastmcpPython framework for building MCP servers, clients, and interactive apps | 92 out of 100 |