█████ █████ ████ █ █ ███ █ █ ███ █ █ █ █ █ ██ ██ █ ██ █ █ █ █ █ ███ ████ █ █ █ █ █ █ █ █████ █ █ █ █ █ █ █ █ █ ██ █ █ █ █ █████ █ █ █ █ ███ █ █ █ █ █████
█ █ ████ ████ ██ ██ █ █ █ █ █ █ █ ████ █ █ █ █ █ █ ████ █
A sandboxed terminal for Claude and ChatGPT.
67 tools for shell, files, git, network and system work.
One workspace folder. Path jail plus kernel sandbox.
╔══════════╦══════════════╦══════════════════╦═══════════╗ ║ 67 tools ║ 2 transports ║ 2 sandbox layers ║ 0 tunnels ║ ╚══════════╩══════════════╩══════════════════╩═══════════╝
[ view on github ] [ quick start ]
┌────────┐ ┌──────────────┐ ┌─────────────────┐ │ Claude │ ─stdio─► │ terminal-mcp │ ─sandbox-exec─► │ ~/mcp-workspace │ └────────┘ └──────────────┘ └─────────────────┘
┌─────────┐ ┌─────────────┐ ┌─────────────┐ │ ChatGPT │ ─https─► │ Worker /mcp │ ◄─wss─ │ relay-agent │ ─► terminal-mcp └─────────┘ └─────────────┘ └─────────────┘ (127.0.0.1:8787)
Claude connects over stdio. For ChatGPT, a Worker relays requests down one outbound WebSocket from your Mac, so there are no open ports and no domain.
shell █████████████░░░░░░░ 9 files █████████████████░░░ 12 search ██████░░░░░░░░░░░░░░ 4 git ████████████████████ 14 network █████████░░░░░░░░░░░ 6 system ████████████████░░░░ 11 data █████████░░░░░░░░░░░ 6 meta ███████░░░░░░░░░░░░░ 5
tools/
├─ shell (9) run_command run_script start_process read_process
│ write_process wait_process kill_process
│ list_processes kill_all_processes
├─ files (12) read_file write_file append_file edit_file
│ list_directory tree file_info make_directory
│ delete_path move_path copy_path read_many_files
├─ search (4) find_files search_text replace_text count_lines
├─ git (14) git_status git_diff git_log git_show git_blame
│ git_branches git_checkout git_commit git_clone
│ git_push git_pull git_stash git_remotes git_init
├─ network (6) http_request download_file check_port
│ dns_lookup ping public_ip
├─ system (11) system_info disk_usage env_vars clipboard_read
│ clipboard_write screenshot notify open_url
│ listening_ports which_command current_time
├─ data (6) diff_files hash base64 archive json_query json_set
└─ meta (5) sandbox_info sandbox_selftest command_history
clear_history list_capabilities
sandbox
├─ [1] path jail ........... always on
│ every path resolves against the workspace root,
│ symlinks are followed, anything outside is rejected
└─ [2] kernel sandbox ...... strict mode
sandbox-exec on macOS, bwrap on Linux
writes : workspace only
reads : everything except ~/.ssh ~/.aws ~/.gnupg
~/.kube ~/.config/gh ~/.netrc ~/.npmrc
mode path jail kernel sandbox use when
────────── ────────── ─────────────── ───────────────────────────
strict* yes yes normal and exploratory work
workspace yes no toolchain fights the sandbox
off no no throwaway VM only
* default
Every action lands in an append-only audit log at ~/.terminal-mcp/audit.log, outside the workspace, so the agent can’t erase its own tracks.
┌──[ WARNING ]───────────────────────────────────── │ This is a real shell. Inside the workspace the model │ can create, modify and delete anything and reach the │ network. Keep strict mode on, keep the workspace │ disposable, and treat your connector URL like a │ password. └──────────────────────────────────────────────────
needs node >= 20
$ cd terminal-mcp $ npm install $ npm run build $ npm link
$ claude mcp add terminal-mcp -- node "$(pwd)/dist/index.js" \
--root "$HOME/mcp-workspace"$ terminal-mcp
$ npm run smoke
works with: claude-code claude-desktop cursor any stdio client chatgpt (via relay)