Coding Tools MCP Server by xyTom: Files, Commands and Git for Any AI Chat

• Shows how the server is set up

  Returns the server and workspace details, project context it picked up, permission policy, runtime, auth and protocol info.

  Try: “What workspace and permission mode is the server using?”

  Read · server_info

• Checks what commands are allowed

  Reports the command-execution policy and whether Linux Landlock file confinement is active on this machine.

  Try: “Is Landlock confinement active?”

  Read · check_exec_environment

• Reads part of a file

  Streams a limited range of a UTF-8 file without loading the whole file.

  Try: “Read lines 1 to 80 of src/app.py”

  Files · read_file

• Lists a folder

  Lists the entries of one folder, or a bounded number of levels down.

  Try: “List the src folder”

  Files · list_dir

• Finds files by pattern

  Walks the workspace for files with glob, ignore, hidden-file, sorting and result-count options.

  Try: “Find all *.test.js files”

  Files · list_files

• Searches file contents

  Searches for literal text or a regex and stops after the result cap.

  Try: “Search for TODO in the repo”

  Files · search_text

• Edits several files in one patch

  Applies a patch that can add, update, delete and move files. Every change is checked first and written atomically, and a failure rolls earlier files back.

  Try: “Patch src/app.py to rename load() to load_config()”

  Delete · apply_patch

• Edits files by line number

  Creates, writes, edits, deletes, moves or copies files by line, against a known file revision so stale edits are rejected.

  Try: “Replace lines 10 to 12 of config.py with this block”

  Delete · apply_changes

• Runs a command in the workspace

  Starts a command and waits up to 10 seconds by default. In the default safe mode, commands that look like network use, shell expansion, inline scripts and destructive actions are blocked.

  Try: “Run the test suite”

  Runs code · exec_command

• Sends input to a running command

  Polls or types into a command that is still running, such as a REPL or debugger.

  Try: “Type "continue" into the debugger”

  Runs code · write_stdin

• Stops a running command

  Terminates one command that this server started.

  Try: “Kill the test run”

  Delete · kill_command

• Pages through long command output

  Reads the saved stdout or stderr of a command by byte offset.

  Try: “Show the next page of output”

  Read · read_output

• Shows the working tree status

  Returns a structured list of changed, staged and untracked files.

  Try: “What has changed in the repo?”

  Read · git_status

• Shows staged or unstaged changes

  Returns a bounded unified diff of staged or unstaged changes.

  Try: “Show my unstaged diff”

  Read · git_diff

• Shows commit history

  Returns a bounded, structured list of recent commits.

  Try: “Show the last 10 commits”

  Read · git_log

• Shows one commit or revision

  Returns metadata, content or the diff of a revision, within a size cap.

  Try: “Show commit abc123”

  Read · git_show

• Shows who last changed each line

  Returns line-by-line attribution for a file, within a size cap.

  Try: “Who last changed lines 20 to 40 of app.py?”

  Read · git_blame

• Shows an image file to the assistant

  Returns one image from the workspace as an image block, with its size and type. It is disabled for clients that cannot take images.

  Try: “Look at docs/diagram.png”

  Files · view_image

Watch out for

• It runs commands on your computer

  exec_command runs commands in the workspace, and there is no read-only mode. The default safe mode blocks network-looking commands, shell expansion and inline scripts, but the README says it is not a complete OS sandbox, so use the Docker image or a VM for untrusted code. github.com

• Trusted and dangerous modes loosen the guard

  Trusted mode opens network, shell expansion and inline scripts. Dangerous mode turns off the command permission checks and Landlock, so use it only inside a container or VM. github.com

• It can edit and delete files in the workspace

  apply_patch and apply_changes can create, overwrite, move and delete files. Path escapes and symlinks outside the workspace are rejected. github.com

• It sends anonymous usage telemetry by default

  Per-tool success and speed counts, version and platform go to PostHog, with no paths, arguments or file contents. Set CODING_TOOLS_MCP_TELEMETRY=off or DO_NOT_TRACK=1 to stop it. github.com

• File confinement is Linux only

  Landlock filesystem confinement applies on Linux hosts that support it. Other systems get a warning instead. github.com

Security advisories