Scripthold MCP server

Scripthold — Secure MCP Server for Local Workspaces

<!-- mcp-name: io.github.zoster81/scripthold -->

Code from the web. Work locally. Recover safely.

Scripthold is a Model Context Protocol (MCP) server that gives web, desktop, and CLI agents controlled access to explicitly authorized local workspaces. It safely handles legacy text encodings, deterministic file changes, source navigation, backups, and optional durable local execution over stdio or authenticated Streamable HTTP.

AI clients see Настройки — not ???? or Íàñòðîéêè.

What Scripthold provides

The current public release is Scripthold 3.2.1 with 38 tools and 3 guided prompts.

• 168 registered text encodings with content-based detection, UTF-32 LE/BE support, and conservative ambiguity handling.
• 101 active Source Intelligence providers for bounded declaration navigation, structural search, selected project relations, and verified context assembly.
• Secure workspace boundaries with canonical-root containment, Windows reparse/junction handling, deterministic traversal, and missing-path validation.
• Approval-bound mutations using preview/apply capabilities, exact fingerprints, conflict checks, staged writes, and truthful partial-state reporting.
• Optional persistent backups with history, compare, audit, restore, explicit garbage collection, pinning, and exact-ID deletion.
• Durable asynchronous tasks with idempotency, persistent state, bounded logs, recovery, locks, and cancellation.
• Reliable long-running read-only calls through optional deferred-operation storage and bounded retained-result retrieval.
• Authenticated Streamable HTTP with loopback defaults, bearer authentication, Host/Origin validation, resource limits, and explicit TLS/proxy requirements for non-loopback exposure.

Scripthold originated from the original mcp-file-tools project, created by Dimitar Grigorov, and retains its GPL-3.0 lineage. See Project Direction.

Quick start

Use a published release

Download the asset for your platform from the latest release and verify it against checksums.txt. Releases also attach a signed Sigstore build-provenance bundle for the normal GoReleaser assets.

Build from source

git clone https://github.com/zoster81/scripthold.git
cd scripthold
go test ./...
go build -o scripthold ./cmd/scripthold

The module path is github.com/zoster81/scripthold.

Local stdio client

Shortened. The full README is on GitHub.