An MCP coding runtime that treats safety as the product

What it does

Coding Tools MCP is a Model Context Protocol server that exposes twenty file, execution, git, and runtime tools to any compatible AI client. It sits between your chat app and your codebase, letting the model read files, apply multi-file patches, run commands in a PTY, and inspect git history — all confined to a single workspace root with path traversal blocked. You wire it into Claude Desktop, Cursor, Cline, or a custom agent loop, and the same fixed tool catalog works regardless of which model is driving.

The interesting bit

The safety architecture is unusually thorough for a developer tool: Linux hosts get kernel-level Landlock filesystem confinement, permission modes gate network access and destructive commands, and the tool catalog is deliberately fixed so models can’t game annotations by switching profiles. Even context-window efficiency is treated as engineering — serialized result bytes dropped 37% release-over-release on their dogfood workload.

Key highlights

• Model- and vendor-neutral: one annotated tool catalog, no profile switching games
• Three permission modes (safe, trusted, dangerous) that change policy without hiding tools from the model
• apply_patch is the only file-mutation primitive, applying staged, baseline-checked, atomic multi-file changes
• Ships via both PyPI and npm (the latter is a thin launcher), with Streamable HTTP or stdio transport
• Bundled Cloudflare Worker control plane spins up ephemeral Docker sandboxes via GitHub Actions runners

Caveats

• Landlock kernel confinement is Linux-only; macOS and Windows get path-boundary checks but an explicit warning that they are not complete OS sandboxes
• Telemetry is on by default (anonymous counters, not file contents), though it can be disabled with an env var
• The npm package is just a launcher that bootstraps the Python server via uv or pipx, not a native Node implementation

Verdict

Worth a look if you want to turn Claude Desktop or another MCP client into a coding agent without buying another SaaS product. Skip it if you need a language-native LSP or deep IDE integration — this is a runtime sandbox, not an editor.