Osmcp MCP server

osmcp — OS Capabilities for AI Agents

A typed, policy-controlled OS capability layer for AI agents via the Model Context Protocol (MCP).

osmcp exposes a curated set of safe filesystem, git, and text-processing tools to AI agents — all governed by a strict Policy Engine that enforces path boundaries, tool allowlists, output limits, mutation controls, and an immutable audit trail.

📖 Read the comprehensive Architecture & Design Document for a deep dive into the philosophy, safety boundaries, and design decisions behind osmcp.

Features

Architecture

AI Agent (Claude, GPT, etc.)
    │  MCP JSON-RPC (stdio)
    ▼
osmcp binary
    ├── Policy Engine      ← enforces allowed_root, allowed_tools, limits
    ├── Audit Logger       ← append-only NDJSON log of every invocation
    ├── Tool Registry      ← self-registering tools via RegisterMCP()
    └── Envelope Builder   ← typed {ok, data, error, meta} responses

Demo

A demonstration of Claude Desktop securely editing code via osmcp, safely bounded by a TOML policy engine.

Quick Start

1. Install via Homebrew

brew tap KrushnaVardhanReddy/tap
brew install osmcp

Alternatively, build from source:

make build
# Binary: bin/osmcp

2. Configure a Policy

# policy.toml
[policy]
allowed_root   = "/home/user/myproject"
allowed_tools  = ["grep", "ls", "cat", "git_status", "git_log"]
allow_mutation = false

[limits]
timeout_ms       = 5000
max_output_bytes = 1048576
max_matches      = 100

[audit]
destination = "stderr"   # or "file"
path        = "/var/log/osmcp-audit.ndjson"

3. Run

bin/osmcp --policy policy.toml

The binary communicates over stdio using MCP JSON-RPC. Connect any MCP-compatible client.

Client Integrations

Claude Desktop

Add the following to your claudedesktopconfig.json:

{
  "mcpServers": {
    "osmcp": {
      "command": "osmcp",
      "args": ["--policy", "/absolute/path/to/policy.toml"]
    }
  }
}

Smithery (npx)

To install osmcp for Claude Desktop automatically via Smithery:

npx @smithery/cli install osmcp

LiteLLM

Integrate osmcp into your enterprise LLM proxy using the LiteLLM MCP Gateway.

5. Test

make test     # unit tests
make e2e      # end-to-end tests against real binary
make lint     # golangci-lint

Policy Security Model

• allowedroot — All filesystem paths are validated to be inside this root. Traversal outside is blocked with POLICYDENIED.
• allowedtools** — Only tools in this list are visible to the MCP client. Unlisted tools do not appear in tools/list.
• allowmutation** — When false, mutating tools (write, delete, git commit) are globally blocked.
• Limits — Per-invocation timeout, output byte cap, and match count cap prevent runaway operations.

Envelope Response Format

All tool responses follow a consistent typed envelope:

Shortened. The full README is on GitHub.