About MCPort
MCPort is a local-first MCP tool for working with projects through AI. It lets an AI client read code, search files, understand symbols, inspect Git, edit files, and—when explicitly authorized—run controlled development commands inside selected Workspaces.
Project files, runtime state, and credentials stay on your machine by default. You can use MCP locally or enable OAuth/Bearer Token access for selected Workspaces over the public internet.
Features
- Read and search project files, source code, images, and directories
- Code indexing plus definition, reference, Hover, and document-symbol support
- Git status, diffs, history, and blame
- Contained file creation, editing, import, copy, move, and deletion
- Checkpoints, tasks, validation, and recovery for file changes
- Controlled command execution with allowlists, timeouts, output limits, and local confirmation
- Local or public MCP access for one or more Workspaces
- Per-language LSP installation and updates, with custom server support
- Optional Computer Use with screen, mouse, and keyboard control gated by per-action approval
Connections
Local access accepts loopback requests by default. Public access can use Cloudflare Tunnel, TryCloudflare, FRP Client, or an external tunnel, with OAuth (recommended) or Bearer Token authentication.
Public Workspaces use routes like:
Files, code, and LSP
File operations remain inside the selected Workspace after realpath and symlink checks. The built-in code index supports TypeScript/JavaScript, Python, Go, Rust, Java, C/C++, and PHP.
Language servers are managed independently and can be installed or updated on demand. Supported languages include TypeScript/JavaScript, HTML, CSS/SCSS/LESS, Python, JSON, YAML, Markdown, Go, Rust, Java, C, C++, and PHP. Custom LSP definitions can be added for other languages.
Permission tiers
- readonly: project browsing, search, code understanding, read-only Git, and history
- standard: file changes, imports, checkpoints, tasks, and quick validation
- full: controlled commands, command sessions, recovery, and complete validation
Commands use an executable name plus an argument array, never an arbitrary shell string. They remain subject to the global command switch, exact allowlist, timeouts, output limits, and high-risk confirmation.
Computer Use is disabled by default and initially available only on local MCP connections in the full tier. A separate switch can expose it to authenticated public Workspaces using the full tier. Screenshots and desktop input still require explicit MCPort Desktop confirmation for every action.
Security
Workspace boundaries are checked after resolving real paths and symlinks. File changes support SHA256 baselines, transactional rollback, and checkpoints. Public Workspaces always require authentication. Tokens, tunnel credentials, and other secrets use system secure storage and are redacted from logs and traces.
The Runtime runs as the logged-in OS user. The command allowlist is not an operating-system sandbox.
