Execkit MCP server

execkit

Persistent, structured shell sessions for AI agents, on your laptop, your servers over SSH, and your Docker containers.

What you get that a built-in agent shell doesn't:

calls, and every command returns a structured result: split stdout/stderr, exit code, duration, cwd.

• Persistent sessions on local, SSH and Docker. cd and env carry across

model sees them, and output budgets (tail, head, grep, a char cap) keep a noisy build from flooding the context window.

• Output that protects the agent's context. Secrets are redacted before the

audit log, you can watch sessions live in a terminal or browser (above), and remote sessions can checkpoint and restore the workspace files.

• An audit trail, a live viewer, and undo. Every command can go to a JSONL

Install

Zero-install, with uv. Add this to your MCP client config:

{ "mcpServers": { "execkit": { "command": "uvx", "args": ["execkit-mcp"] } } }

Or install it and let execkit print the config for your client:

pip install execkit-mcp && execkit-mcp setup claude   # or: cursor | gemini | codex | vscode | windsurf

Then execkit-mcp doctor checks your setup. More options (prebuilt binary, cargo install, building from source) are in the Quickstart.

Status: early 0.x. The API may change between minor versions. Read Limitations before pointing it at anything important.

Where it fits

execkit complements your agent's built-in shell or sandbox; it does not replace it. Use it when the agent needs to work on a remote host or inside a container, when you want a record of what ran, or when you want to undo file changes on a remote workspace.

The agent is the adversary. The LLM driving execkit can be prompt-injected by anything it reads, so execkit contains its own caller: a command passes the policy fence before it runs, secrets are redacted before output returns, and a changed SSH host key fails loudly instead of reconnecting into a MITM.

flowchart LR
    A([AI agent]) -->|command| F{policy fence}
    F -->|blocked| X([rejected, never runs])
    F -->|allowed| T[transport: local / SSH / Docker]
    T --> O[raw output]
    O --> R[redact secrets, bound output]
    R --> E([structured ExecResult])
    E -.-> A

Use it from an agent (MCP)

The agent gets sessioncreate (local, ssh, or docker), sessionexec, sessionlist and sessiondestroy, plus sessioncheckpoint / sessioncheckpoints / session_restore for remote undo.

State persists across calls, and every result is parsed, not scraped from a terminal:

// session_exec {"command": "cd /app && npm ci"}   -> { "exit_code": 0, "cwd": "/app" }
// session_exec {"command": "npm run build"}        // cwd is still /app
//   -> { "stderr": "Error: Cannot find module 'webpack'",
//        "exit_code": 1, "duration_ms": 3420, "cwd": "/app",
//        "truncated": false, "timed_out": false }

Shortened. The full README is on GitHub.