Ghostlink MCP server

GhostLink

A security-hardened MCP server that gives AI coding agents safe, deterministic access to local repositories.

Add it to any MCP client that supports STDIO. For Claude Code, create .mcp.json in the target repo root:

{
  "mcpServers": {
    "ghostlink": {
      "command": "npx",
      "args": ["-y", "@bgorzelic/ghostlink"],
      "env": {
        "GHOSTLINK_REPO_ROOT": "/path/to/target/repo"
      }
    }
  }
}

Then run claude in that directory — six repo tools appear, all confined to GHOSTLINKREPOROOT. Every tool call returns the same deterministic ToolEnvelope:

{
  "ok": true,
  "data": { ... },
  "provenance": { "tool": "repo.search", "timestamp": "2026-02-24T...", "duration_ms": 42 }
}

On error, "error": { "code": "...", "message": "..." } replaces "data". Full tool schemas: docs/TOOLS.md.

Tools

What is GhostLink?

GhostLink is a local-first Model Context Protocol server that exposes your codebase to AI coding agents through a small set of policy-gated tools. It solves a specific problem: AI agents need to search, read, patch, and verify code, but giving them raw shell access is a liability. GhostLink provides a sandboxed capability plane where every tool call is confined to a single repository root, every output follows a deterministic JSON shape, and every invocation is audit-logged.

Why GhostLink?

Architecture

GhostLink is a three-layer stack designed for extensibility without core changes:

Shortened. The full README is on GitHub.