{ "markdown": "

\n \"Tidesman\n

\n\n

Tidesman

\n\n

\n A free native MCP server for running, understanding, and debugging Linux containers with Apple's container tool.\n

\n\n

\n \"Latest\n \"Homebrew\n \"macOS\n \"MCP\n \"License:\n

\n\n

\n Website ·\n Downloads\n

\n\nIt lets an AI assistant (Claude Desktop, Claude Code, or any MCP-compatible client) list,\nrun, inspect, and clean up Linux containers on your Mac, safely and with a full audit trail.\n\n> This repository is the public download and documentation home for Tidesman. The source is\n> maintained privately; the binaries published here are signed with an Apple Developer ID\n> certificate and notarized by Apple.\n\n## Demo\n\n\n

Demo coming with the first release.

\n\n## What it is\n\n

\n \"How\n

\n\nMCP (Model Context Protocol) is an open standard that lets an AI assistant call external\ntools: small functions that do real work, such as listing or starting containers. Tidesman is\nthe server side of that standard: it offers a set of container tools, and the AI is the client\nthat calls them.\n\nApple's `container` is Apple's tool for running Linux containers on macOS. Normally you drive\nit by typing commands in a terminal. Tidesman instead talks straight to the background service\nthat `container` relies on (its \"apiserver\"), using Apple's own Swift client library. Going\ndirectly to that service is faster and sturdier than wrapping the command line.\n\n## Requirements\n\n- An Apple Silicon Mac running macOS 26 (Apple's container runtime requires both).\n- Apple's `container` installed and started: `container system start`.\n\n## Install\n\nTidesman is a signed, notarized binary. Pick whichever channel suits you.\n\n### Homebrew (recommended)\n\n```\nbrew install JeronimoColon/tidesman/tidesman\n```\n\nThis adds the tap and installs `tidesman` to `/opt/homebrew/bin`.\n\n### Installer package (.pkg)\n\nDownload `tidesman-.pkg` from the\n[latest release](https://github.com/JeronimoColon/tidesman-mcp/releases/latest), double-click\nit, and follow the prompts. It installs `tidesman` to `/usr/local/bin`. The package is signed,\nnotarized, and stapled, so it verifies even offline.\n\n### Direct binary (zip)\n\nDownload `tidesman--macos-arm64.zip`, unzip it, and move `tidesman` onto your PATH.\nBecause the bare binary is not stapled, macOS checks it online the first time you run it.\n\n### Claude Desktop one-click (.mcpb)\n\nDownload `tidesman-.mcpb` and open it with Claude Desktop (Settings → Extensions). The\nbundle embeds the signed binary and registers the server for you in read-only mode.\n\n### Verify your download\n\nEvery release ships a `SHA256SUMS` file. From the folder holding your downloads:\n\n```\nshasum -c SHA256SUMS\n```\n\n## Configure your MCP client\n\nTidesman runs as a local command your client launches over standard input/output. Point the\nclient at the binary and pass an access mode with `--mode` (omit it for read-only).\n\nClaude Desktop, edit `~/Library/Application Support/Claude/claude_desktop_config.json`:\n\n```json\n{\n \"mcpServers\": {\n \"tidesman\": {\n \"command\": \"/opt/homebrew/bin/tidesman\",\n \"args\": [\"--mode=safe\"]\n }\n }\n}\n```\n\nClaude Code:\n\n```bash\nclaude mcp add --transport stdio --scope user tidesman \\\n -- /opt/homebrew/bin/tidesman --mode=safe\n```\n\nAny stdio MCP client (OpenAI Codex and others) works the same way: point it at the binary and\npass the flags as arguments.\n\n## What it does\n\nTwenty tools, each tagged by what it can do (Read, Write, or Destructive). Three report on\nor repair the engine itself, eleven act on containers, six on images:\n\n| Tool | Capability | What it does |\n|---|---|---|\n| `system_ping` | Read | check the container service is reachable |\n| `system_disk_usage` | Read | report disk use for images, containers, and volumes |\n| `system_repair` | Write | re-download the engine's own infrastructure images |\n| `container_list` | Read | list containers |\n| `container_inspect` | Read | show a container's full details |\n| `container_logs` | Read | fetch a container's recent output |\n| `container_run` | Write | create and start a container from an image |\n| `container_exec` | Write | run a command inside a running container |\n| `container_start` | Write | start an existing stopped container |\n| `container_restart` | Write | gracefully stop and then start a container |\n| `container_stop` | Write | gracefully stop a running container |\n| `container_kill` | Write | stop a container by sending it a signal (SIGKILL by default) |\n| `container_delete` | Destructive | remove a container |\n| `container_prune` | Destructive | remove every stopped container in one sweep |\n| `image_list` | Read | list the images already downloaded |\n| `image_inspect` | Read | show an image's full details |\n| `image_pull` | Write | download an image from a registry |\n| `image_tag` | Write | give an existing image another name |\n| `image_delete` | Destructive | remove an image |\n| `image_prune` | Destructive | remove untagged (or all unused) images in one sweep |\n\nWhat the capability tags mean: a **Read** tool observes state and changes nothing. A **Write**\ntool changes state but never removes a resource; a stopped container survives a start or a\nrestart and an engine repair only restores what the engine needs. **Destructive** is reserved\nfor removing containers or images. Your MCP client may separately mark some write tools (exec,\nstop, kill, restart) as destructive, based on the MCP hints each tool carries: those tools can\nend work or change data inside a container, even though the container itself survives. In\nevery mode, all twenty tools stay visible to your assistant; a tool the mode locks says so in\nits description and refuses until you raise the mode.\n\n## Access modes: safe by default\n\nTidesman runs at one of three authority levels, set with `--mode=`, and it starts in the\nsafest one. If no `--mode` is given, it is read-only. Every tool is always listed to your\nassistant; the mode controls which of them may run.\n\n| Mode | Allows | Tools callable |\n|---|---|---|\n| `read-only` (default) | Read | ping, disk usage, list, inspect, logs, and the two image reads (7) |\n| `safe` | Read + Write | the above, plus run, exec, start, restart, stop, kill, image pull and tag, and the engine repair (16) |\n| `full` | Read + Write + Destructive | all twenty, including the delete and prune tools |\n\nA separate flag, `--allow-host-mounts=/path/one[,/path/two]`, names the host folders\n`container_run` may mount into a container; it is off by default because a host mount reaches\noutside the container's isolation onto your real files. A mount is allowed only when its real\npath (with symlinks resolved) sits under one of the folders you list.\n\n## Security and trust\n\n- Signed and notarized. The binary is signed with an Apple Developer ID certificate and\n notarized by Apple, so Gatekeeper runs it without a warning.\n- Safe by default. Unset mode is read-only; destructive operations require `full`; host mounts\n require an explicit flag.\n- Audited. Every tool call is recorded to `~/Library/Logs/tidesman/audit.log` and the macOS\n unified log: its name, its arguments (with secret-like values redacted), and its outcome.\n A destructive call also records exactly what it removed, and arguments a tool does not\n declare are recorded by name, so a mistaken call leaves a visible trace.\n- Honest tool annotations. Every tool declares MCP read-only and destructive hints that match\n what it can actually touch, so your client knows the stakes and can ask before anything\n risky runs.\n- Guard your client config. Tidesman's tools cannot change the access mode; it is pinned by\n the `--mode` argument in your MCP client's configuration file. That file lives outside\n Tidesman's control, so protect it accordingly: a client that grants its assistant broad\n filesystem access would let the assistant edit its own mode. Every audit-log line records\n the mode the call ran under, so any change leaves a visible trail.\n\n## Privacy Policy\n\nTidesman collects nothing about you and sends nothing to us: no telemetry, no analytics, no\ncrash reporting, no accounts. Everything it does happens on your Mac.\n\n- The audit log (tool calls, arguments with secret-like values redacted, outcomes) is written\n only to your Mac (`~/Library/Logs/tidesman/audit.log` and the macOS unified log) and stays\n there unless you share it yourself. Delete it whenever you like.\n- Tidesman opens no network ports. Its only outbound connection is to a container registry\n (such as Docker Hub) when you or your assistant asks it to pull an image; that request shares\n the image name and your network address with the registry, like any container tool.\n- Nothing is shared with, sold to, or retained by anyone else.\n\nThe full policy lives at [tidesman.dev/privacy.html](https://tidesman.dev/privacy.html).\nPrivacy questions: [legal@tidesman.dev](mailto:legal@tidesman.dev).\n\n## License\n\nTidesman is proprietary software, provided free of charge under the end-user license in\n[EULA.txt](EULA.txt). It bundles open-source components whose notices are preserved in\n[THIRD-PARTY-LICENSES](THIRD-PARTY-LICENSES).\n\n## Links\n\n- Website: https://tidesman.dev\n- Report an issue: https://github.com/JeronimoColon/tidesman-mcp/issues\n- Contact: hello@tidesman.dev\n", "bytes": 10602, "sha": "1d3302298b5dbc0c115ae1c0c32243bb1dc8c916a464453331e082dffaeb8d58", "repo_slug": "jeronimocolon/tidesman-mcp", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_dev_tidesman_tidesman_f7a0596b/readme" }