商业产业 Hacker News AI 2026-07-28T17:04 正文 ok 1109 words

🔶 Coding Tools MCP（v0.2.2）：为任何 AI 聊天或 Agent 赋予操作代码的双手

英文标题：🔶 Coding Tools MCP (v0.2.2):Give any AI chat or agent a pair of hands on your code

Coding Tools MCP 是一个通过 Model Context Protocol（MCP）提供的模型中立型编码运行时，可让 Claude Desktop、Claude Code、Cursor、Cline 或自建 Agent 获得受控的代码仓库访问能力。该项目提供 20 个经过验证的工具，覆盖文件读取与搜索、多文件补丁、命令执行、交互式会话和 Git 操作，并以工作区边界和权限模式限制风险。项目称，在保持任务完成效果不变的确定性内部工作负载中，其序列化工具结果字节量较上一版本下降了 37%。对开发者而言，它提供了可在本地、远程隧道、Docker 沙箱和云端临时环境中复用的 MCP 编码基础设施，同时强调权限控制、Linux Landlock 文件系统隔离与可审计的发布验证流程。

打开原文相关 6 · 机会 3

1.2 KB

1.3 KB

2.2 KB

1.3 KB

229.3 KB

210.9 KB

中文

英文 | 简体中文

为任何 AI 聊天应用或 Agent 安全地赋予操作代码库的双手。

Coding Tools MCP 是一个通过 Model Context Protocol 提供服务的模型中立型编码运行时：文件读取与搜索、结构化多文件补丁、命令执行、交互式会话和 Git 操作均由同一台服务器提供，任何 MCP 客户端都可以驱动它。Claude Desktop、Claude Code、Cursor、Cline，或你自行构建的 Agent，都能获得同样一套经过实战验证的 20 个工具；这些工具被限制在单一工作区内，并受权限模式控制。

它能将聊天应用变成编码 Agent。 Claude Desktop，或任何 MCP 聊天客户端，都可借助你已有的订阅获得真实仓库访问权限，无需额外产品。
安全性是产品本身，而非事后补充。 每台服务器仅对应一个工作区根目录。系统会拒绝绝对路径、.. 路径穿越和符号链接逃逸。权限模式会限制网络访问、shell 展开、内联脚本和破坏性命令。在 Linux 上，Landlock 会增加内核级文件系统隔离。
它在模型和厂商之间保持中立。 工具目录固定且如实标注——没有配置档切换，也没有标注技巧。你可以自由更换模型或客户端，运行时及其行为保持不变。
它针对上下文窗口进行了工程化设计。 结果会被汇总、分页，并按设计设置上限；在任务完成结果不变的确定性内部工作负载中，序列化工具结果字节数较上一版本下降了 37%。

使用你现有的任意工具链运行它即可（服务器是通过 PyPI 发布的 Python ≥ 3.11 软件包；npm 软件包是一个轻量启动器，通过 uv 或 pipx 启动服务器）：

uvx coding-tools-mcp --stdio --workspace /path/to/repo   # Python 工具链
npx coding-tools-mcp --stdio --workspace /path/to/repo   # Node 工具链

将其接入 Claude Desktop、Claude Code、Cursor 或 Cline——各处使用的 JSON 都相同（如偏好 Node，可将 uvx 替换为 npx）：

{
  "mcpServers": {
    "coding-tools": {
      "command": "uvx",
      "args": ["coding-tools-mcp", "--stdio", "--workspace", "/path/to/repo"]
    }
  }
}

随后向客户端提出请求：“运行测试套件并修复第一个失败项。”

更偏好 HTTP？移除 --stdio 后，服务器会在 http://127.0.0.1:8765/mcp 上通过 Streamable HTTP 提供服务（MCP 2025-11-25，兼容 2025-06-18）。一行安装命令、各客户端接入指南和故障排查说明位于 docs/quickstart.md 和 docs/mcp-client-config.md。

1. 将 Claude Desktop 变成你的编码 Agent。 上述配置即可完成接入——你已经付费使用的聊天窗口现在能够读取、修改、测试真实仓库，并审查提交。

2. 随时随地操作自己机器上的代码。

CODING_TOOLS_MCP_AUTH_MODE=bearer ./scripts/tunnel.sh cloudflared /path/to/repo

使用回环地址绑定加经认证的 HTTPS 隧道（cloudflared、ngrok 或 Microsoft Dev Tunnel）。在手机上的 claude.ai 中指向 https://<tunnel-host>/mcp，即可从任意地点操作家中工作站。内置 Bearer Token 以及 OAuth 2.1 + PKCE（支持 RFC 7591 动态注册）。→ docs/remote-mcp.md

3. 让 Agent 在不可信代码上自由运行——但置于一次性沙箱中。

docker build -t coding-tools-mcp-sandbox:local .
docker run --rm --init -it -p 8765:8765 -v "$PWD:/workspace" coding-tools-mcp-sandbox:local

容器化服务器预配置了工具链和缓存，可安全地指向可疑 PR，之后直接销毁即可。→ docs/docker.md

4. 通过一次 MCP 调用启动云端沙箱。 内置的 Cloudflare Worker 控制平面将 start_coding_tools_sandbox 作为 MCP 工具公开：一次调用即可调度 GitHub Actions runner，启动 Docker 沙箱，并通过经过认证的 Cloudflare Tunnel 将其发布。提供临时计算资源，无需自行维护服务器。

5. 通过 GUI 驱动它。

python -m pip install "coding-tools-mcp[desktop]"
coding-tools-mcp-desktop

支持按工作区配置档案、启动或停止服务器及隧道、借助剪贴板辅助进行凭据设置、实时健康检查。提供英文和简体中文界面。

6. 保持交互式会话持续运行。 exec_command 会在真实 PTY 下启动 REPL 或调试器；write_stdin 可跨轮次向其输入内容；read_output 可对长输出进行分页；kill_session 用于清理会话。长时间运行的进程被作为一等能力支持，并具有截止时间监视器和有界缓冲区。

7. 为你自己的 Agent 提供生产级操作能力。 正在使用 Anthropic SDK 或其他工具构建 Agent 循环？无需自行实现文件和执行工具——通过 MCP 与此服务器通信，即可继承完整的安全边界。→ docs/embedding.md

提供一套稳定且如实标注的工具：权限模式只改变命令的_策略_，绝不改变模型可见的工具集合。apply_patch 是唯一的文件修改原语：支持暂存、基线检查、跨文件原子操作和回滚。

组别	工具
文件与搜索	`read_file` · `list_dir` · `list_files` · `search_text` · `apply_patch` · `view_image`
执行	`exec_command` · `write_stdin` · `read_output` · `kill_session` · `request_permissions`
Git	`git_status` · `git_diff` · `git_log` · `git_show` · `git_blame`
运行时	`server_info` · `check_exec_environment` · `get_default_cwd` · `set_default_cwd`

根目录中的 AGENTS.md/CLAUDE.md 文件会自动加载至初始化上下文。工具的 content 提供简明、面向 Agent 的文本；structuredContent 则承载完整的机器可读结果。Schema 和结果封装详见：docs/tools-and-schemas.md · docs/runtime-contract-v0.2.md。

模式	适用场景	允许内容
`safe`（默认）	日常 Agent 工作	文件工具和经审核的命令；看似网络相关的命令、shell 展开、内联脚本和破坏性命令均需明确授权
`trusted`	本地开发	开放网络、shell 展开和内联脚本；保留密钥过滤与破坏性命令检查
`dangerous`	仅限隔离容器/VM	禁用 `exec_command` 权限门控；工作区路径边界仍然生效

递归列举和搜索会排除 .git、node_modules、构建输出、虚拟环境和缓存。命令在受工作区约束的 cwd、清理后的环境变量、超时和输出上限下运行。启用 Landlock 的 Linux 主机可获得内核强制执行的文件系统隔离；其他平台会显示明确警告——这仍不是完整的操作系统沙箱，因此对于真正不可信的工作，请使用 Docker 镜像或 VM。详情：SECURITY.md · docs/security-boundary.md · docs/permission-modes.md

服务器会发送匿名使用遥测数据（按工具统计的成功率/延迟计数器，以及版本/平台维度——绝不包含路径、参数、命令或文件内容），以帮助确定修复优先级。可通过 CODING_TOOLS_MCP_TELEMETRY=off 或 DO_NOT_TRACK=1 禁用；在 CI 中会自动关闭。设置 CODING_TOOLS_MCP_TELEMETRY=debug 会将每个事件输出至 stderr，而不是发送出去。完整事件列表和保障说明见 docs/telemetry.md。

证据、内部实测与 SWE-bench

每次发布都会经过由标签触发的流水线：合规套件、真实工作负载基准测试和 SWE-bench 测试框架，均从同一个提交运行；该提交同时发布至 PyPI 和 npm，二者均采用可信发布，npm 包含来源证明。内部实测效率指标可复现（make dogfood-smoke），并提交在 reports/ 目录下。本仓库并不声称拥有模型生成的 SWE-bench 排行榜成绩——请参阅 docs/swe-bench.md，了解具体测量和未测量的内容。更多信息：COMPLIANCE.md · BENCHMARK.md · docs/dogfood.md

python -m pip install -e ".[dev]"
make ci        # lint、类型检查、测试、协议/集成套件、门禁

完整门禁矩阵见 docs/ci-and-tests.md。

本项目采用 Apache License 2.0 授权。

项目：Coding Tools MCP
作者：Coding Tools MCP Contributors
源码：https://github.com/xyTom/coding-tools-mcp

引用元数据可在 CITATION.cff 中获取。

English / 原文

English | 简体中文

Give any AI chat or agent a safe pair of hands on your codebase.

Coding Tools MCP is a model-neutral coding runtime served over the Model Context Protocol: file reading and search, structured multi-file patches, command execution, interactive sessions, and git — one server that any MCP client can drive. Claude Desktop, Claude Code, Cursor, Cline, or an agent you build yourself all get the same 20 battle-tested tools, confined to one workspace, gated by permission modes.

It turns a chat app into a coding agent. Claude Desktop — or any MCP chat client — gets real repo access with the subscription you already have. No extra product required.
Safety is the product, not an afterthought. One workspace root per server. Absolute paths, .. traversal, and symlink escapes are rejected. Permission modes gate network access, shell expansion, inline scripts, and destructive commands. On Linux, Landlock adds kernel-level filesystem confinement.
It is model- and vendor-neutral. A fixed, truthfully annotated catalog — no profile switching, no annotation games. Swap models or clients freely; the runtime and its behavior stay put.
It is engineered for context windows. Results are summarized, paginated, and capped by design; serialized tool-result bytes dropped 37% release-over-release on the deterministic dogfood workload with unchanged task completion.

Run it with whichever toolchain you already have (the server is Python ≥ 3.11 from PyPI; the npm package is a thin launcher that starts it via uv or pipx):

uvx coding-tools-mcp --stdio --workspace /path/to/repo   # Python toolchain
npx coding-tools-mcp --stdio --workspace /path/to/repo   # Node toolchain

Wire it into Claude Desktop, Claude Code, Cursor, or Cline — the JSON is the same everywhere (swap uvx for npx if you prefer Node):

{
  "mcpServers": {
    "coding-tools": {
      "command": "uvx",
      "args": ["coding-tools-mcp", "--stdio", "--workspace", "/path/to/repo"]
    }
  }
}

Then ask your client: "run the test suite and fix the first failure."

Prefer HTTP? Drop --stdio and the server speaks Streamable HTTP on http://127.0.0.1:8765/mcp (MCP 2025-11-25, with 2025-06-18 compatibility). A one-line installer, per-client walkthroughs, and troubleshooting live in docs/quickstart.md and docs/mcp-client-config.md.

1. Make Claude Desktop your coding agent. The config above is all it takes — the chat window you already pay for can now read, patch, test, and commit-review a real repository.

2. Code on your own machine from anywhere.

CODING_TOOLS_MCP_AUTH_MODE=bearer ./scripts/tunnel.sh cloudflared /path/to/repo

Loopback bind + authenticated HTTPS tunnel (cloudflared, ngrok, or Microsoft Dev Tunnel). Point claude.ai on your phone at https://<tunnel-host>/mcp and drive your home workstation from anywhere. Bearer tokens and OAuth 2.1 + PKCE (with RFC 7591 dynamic registration) are built in. → docs/remote-mcp.md

3. Let an agent loose on untrusted code — inside a disposable sandbox.

docker build -t coding-tools-mcp-sandbox:local .
docker run --rm --init -it -p 8765:8765 -v "$PWD:/workspace" coding-tools-mcp-sandbox:local

A containerized server with toolchains and caches preconfigured, safe to point at a sketchy PR and destroy afterwards. → docs/docker.md

4. Spin up a cloud sandbox with one MCP call. The bundled Cloudflare Worker control plane exposes start_coding_tools_sandbox as an MCP tool: one call dispatches a GitHub Actions runner that boots the Docker sandbox and publishes it behind an authenticated Cloudflare Tunnel. Ephemeral compute, no server of your own.

5. Drive it from a GUI.

python -m pip install "coding-tools-mcp[desktop]"
coding-tools-mcp-desktop

Per-workspace profiles, server and tunnel start/stop, credential setup with clipboard helpers, live health checks. English and 简体中文.

6. Keep an interactive session alive. exec_command starts a REPL or debugger under a real PTY; write_stdin feeds it across turns; read_output pages long output; kill_session cleans up. Long-running processes are first-class, with deadline watchdogs and bounded buffers.

7. Give your own agent production-grade hands. Building an agent loop with the Anthropic SDK or anything else? Don't hand-roll file and exec tools — speak MCP to this server and inherit the whole safety boundary. → docs/embedding.md

One stable, truthfully annotated set — permission modes change command policy , never which tools the model sees. apply_patch is the sole file-mutation primitive: staged, baseline-checked, atomic across files, with rollback.

Group	Tools
Files & search	`read_file` · `list_dir` · `list_files` · `search_text` · `apply_patch` · `view_image`
Execution	`exec_command` · `write_stdin` · `read_output` · `kill_session` · `request_permissions`
Git	`git_status` · `git_diff` · `git_log` · `git_show` · `git_blame`
Runtime	`server_info` · `check_exec_environment` · `get_default_cwd` · `set_default_cwd`

Root AGENTS.md/CLAUDE.md files load into the initialize context automatically. Tool content is concise agent-facing text; structuredContent carries the complete machine result. Schemas and result envelopes: docs/tools-and-schemas.md · docs/runtime-contract-v0.2.md.

Mode	Meant for	What it allows
`safe` (default)	day-to-day agent work	file tools and vetted commands; network-looking commands, shell expansion, inline scripts, and destructive commands all require explicit permission
`trusted`	local development	opens network, shell expansion, and inline scripts; keeps secret filtering and destructive-command checks
`dangerous`	isolated containers/VMs only	disables `exec_command` permission gates; workspace path boundaries still apply

Recursive listing and search exclude .git, node_modules, build outputs, virtualenvs, and caches. Commands run with workspace-bound cwd, scrubbed environment, timeouts, and output caps. Linux hosts with Landlock get kernel-enforced filesystem confinement; other platforms get an explicit warning — this is still not a complete OS sandbox, so use the Docker image or a VM for genuinely untrusted work. Details: SECURITY.md · docs/security-boundary.md · docs/permission-modes.md

The server sends anonymous usage telemetry (per-tool success/latency counters and version/platform dimensions — never paths, arguments, commands, or file contents) to help prioritize fixes. Disable it with CODING_TOOLS_MCP_TELEMETRY=off or DO_NOT_TRACK=1; it is automatically off in CI. CODING_TOOLS_MCP_TELEMETRY=debug prints every event to stderr instead of sending. The full event list and guarantees are in docs/telemetry.md.

Evidence, Dogfood and SWE-bench

Every release ships through a tag-triggered pipeline in which the compliance suite, real-workload benchmark, and SWE-bench harness run from the same commit that publishes to PyPI and npm — both via trusted publishing, npm with provenance. Dogfood efficiency metrics are reproducible (make dogfood-smoke) and checked in under reports/. This repository does not claim a model-generated SWE-bench leaderboard result — see docs/swe-bench.md for exactly what is and is not measured. More: COMPLIANCE.md · BENCHMARK.md · docs/dogfood.md

python -m pip install -e ".[dev]"
make ci        # lint, typecheck, tests, protocol/integration suites, gates

The full gate matrix is in docs/ci-and-tests.md.

This project is licensed under the Apache License 2.0.

If you use code, documentation, substantial implementation details, or derivative work from this project, preserve the copyright notice, license notice, and NOTICE file, and clearly attribute the original project.

Project: Coding Tools MCP
Author: Coding Tools MCP Contributors
Source: https://github.com/xyTom/coding-tools-mcp

Citation metadata is available in CITATION.cff.