Coding Tools MCP

First you install and start the server against a folder. With a Python toolchain you run it through uvx, with Node through npx; the npm package is a thin launcher for the Python server. The server speaks stdio by default, or Streamable HTTP on a local port.

Second you wire it into your client. The same small JSON block works in Claude Desktop, Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI and Cline. Root AGENTS.md or CLAUDE.md files in the workspace are loaded automatically and returned to the client as instructions.

Third you ask for work in plain language. The model calls tools such as read_file, search_text, apply_patch, exec_command and git_diff, and the server enforces the workspace boundary and the permission mode on every call.

For remote or riskier work you can expose the server through an authenticated tunnel (cloudflared, ngrok or Microsoft Dev Tunnel) with bearer tokens or OAuth 2.1, run it in the bundled Docker sandbox, or start a disposable cloud sandbox with one MCP call through the included Cloudflare Worker control plane.

• •Coding Tool Catalog - Nineteen annotated tools, 18 advertised by default, across files and search, execution and Git: read_file, list_files, search_text, apply_patch and apply_changes, exec_command with write_stdin and read_output, and git_status, git_diff, git_log, git_show and git_blame.
• •Staged, Atomic Patches - apply_patch and apply_changes are staged, checked against a baseline, atomic across multiple files and support rollback, so an agent's edit either lands completely or not at all.
• •Permission Modes and Workspace Confinement - Safe mode (the default) requires explicit permission for network-looking commands, shell expansion, inline scripts and destructive commands; trusted mode opens those for local development; dangerous mode is meant for isolated containers only. Path escapes are always rejected.
• •Interactive Sessions - exec_command can start a REPL or debugger under a real PTY that stays alive across turns, with deadline watchdogs and bounded output buffers.
• •Remote Access and Sandboxes - Authenticated HTTPS tunnels let claude.ai on a phone, ChatGPT or Grok drive a home workstation, while a Docker image and a Cloudflare Worker that boots a cloud sandbox handle untrusted code.
• •Desktop App and Embedding - An optional desktop GUI manages per-workspace profiles, server and tunnel start and stop, credentials and health checks in English and Simplified Chinese, and developers can embed the server in their own agent loops instead of writing file and exec tools by hand.

Coding Tools MCP is for developers who want an AI model to work on a real repository without handing it an unrestricted shell. People who already pay for Claude Desktop, ChatGPT or another MCP-capable chat app can turn it into a coding agent that reads, patches, tests and reviews code in a chosen folder, using the subscription they already have.

Teams building their own agents with the Anthropic SDK or another framework can use the server as a ready-made, tested set of file, execution and Git tools with a defined safety boundary, rather than hand-rolling those tools themselves. Developers who switch between models and clients benefit from a single model-neutral runtime that behaves the same in Cursor, Codex, VS Code or Gemini CLI.

Security-minded users and maintainers reviewing unfamiliar code can point an agent at a suspicious pull request inside the Docker sandbox and throw the container away afterwards. Developers who want to code on their home machine from anywhere can expose it through an authenticated tunnel and drive it from claude.ai on a phone. Because it is free and Apache-2.0 licensed, the only cost is the AI client or model you connect.