Chisel

What ckanthony/Chisel MCP server does

The ckanthony/Chisel MCP server gives an MCP client a restricted set of file and shell-style operations. Its main editing path is patch_apply, which accepts a unified diff and changes only the lines covered by the patch. If the patch does not match, the operation fails without applying the edit. Raw diffs and diffs inside a diff code fence are supported.

For inspection, the server favors targeted commands over whole-file reads. The shell_exec tool exposes a compile-time whitelist containing grep, sed, awk, find, cat, head, tail, wc, sort, uniq, cut, tr, diff, file, stat, ls, du, and rg. This lets an agent search for headers, extract a section, compare files, or inspect metadata while returning less content to the model.

The remaining file tools cover appending, creating or replacing files, creating directory trees, and moving or renaming files. The server is implemented in Rust and is also associated with a reusable chisel-core library that can be embedded by Rust, Node.js through WebAssembly, or Python through WebAssembly.

How it works

All paths are checked against a configured root before file I/O or process creation. Absolute paths outside that root are rejected, and the confinement check also accounts for symlinks. The same validation applies to paths supplied to shell_exec, so using a permitted command does not bypass the root boundary.

Command execution is restricted to the fixed whitelist. Commands such as rm, bash, sh, curl, chmod, and sudo are not available, and the README states that the list cannot be expanded at runtime by the model. The documented security defaults also include bearer-token authentication, binding to 127.0.0.1, atomic writes, and a read-only mode.

Setup and configuration

The ckanthony/Chisel MCP server can be installed from a pre-built .mcpb bundle, described as a one-click installation with no build step, or from a raw binary published on the GitHub Releases page. The supplied material does not specify a package-manager command or a complete MCP client configuration block.

A deployment needs a configured filesystem root so that the server can enforce path confinement. Bearer-token authentication is part of the documented security model, but the provided material does not identify the token variable, configuration key, or setup syntax. The project also includes an agent skill at skills/chisel/SKILL.md; its README gives npx skills add ckanthony/Chisel as the command to install that skill, not the MCP server itself.

Tools and capabilities

• patch_apply: Apply a raw or fenced unified diff atomically.
• append: Add content to an existing file.
• write_file: Create or overwrite a file and create missing parent directories.
• create_directory: Create nested directories with mkdir -p behavior.
• move_file: Move or rename a file within the configured root.
• shell_exec: Run one command from the fixed Unix-tool whitelist.

The design is suited to agents editing source, documentation, or other files where sending complete file contents would consume unnecessary context. It is less suitable when unrestricted shell access or access outside one configured root is required.