{
  "markdown": "# Scripthold — Secure MCP Server for Local Workspaces\n\n<!-- mcp-name: io.github.zoster81/scripthold -->\n\n[![Test Suite](https://github.com/zoster81/scripthold/actions/workflows/test.yml/badge.svg?branch=main&event=push)](https://github.com/zoster81/scripthold/actions/workflows/test.yml?query=branch%3Amain)\n[![CodeQL](https://github.com/zoster81/scripthold/actions/workflows/codeql.yml/badge.svg?branch=main&event=push)](https://github.com/zoster81/scripthold/actions/workflows/codeql.yml?query=branch%3Amain)\n[![golangci-lint](https://img.shields.io/badge/golangci--lint-v2.12.2-4C8EDA?logo=go&logoColor=white)](.golangci.yml)\n[![Go](https://img.shields.io/github/go-mod/go-version/zoster81/scripthold?logo=go)](go.mod)\n[![Release](https://img.shields.io/github/v/release/zoster81/scripthold)](https://github.com/zoster81/scripthold/releases/latest)\n[![License: GPL-3.0](https://img.shields.io/github/license/zoster81/scripthold)](LICENSE)\n[![MCP Registry](https://img.shields.io/badge/MCP_Registry-Scripthold-blue)](https://registry.modelcontextprotocol.io/?search=io.github.zoster81%2Fscripthold)\n[![Platforms](https://img.shields.io/badge/platforms-Windows%20%7C%20Linux%20%7C%20macOS-555)](.github/workflows/test.yml)\n[![Text encodings](https://img.shields.io/badge/text%20encodings-168-6f42c1)](docs/GLOBAL_ENCODING_COVERAGE.md)\n[![Source providers](https://img.shields.io/badge/source%20providers-101-0b7285)](docs/LANGUAGE_CAPABILITIES.md)\n\n**Code from the web. Work locally. Recover safely.**\n\nScripthold is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that gives web, desktop, and CLI agents controlled access to explicitly authorized local workspaces. It reads and writes legacy text safely, exposes deterministic repository-oriented workflows, supports authenticated Streamable HTTP as well as stdio, and can optionally run durable asynchronous local tasks.\n\nAI clients see `Настройки` — not `????` or `Íàñòðîéêè`.\n\nScripthold detects encodings from bytes and decoded-text evidence rather than filenames, presents text to the MCP client as UTF-8, and preserves or deliberately converts encoding, BOM, and line endings through bounded-memory and durable filesystem operations.\n\n- **36 tools and 3 guided prompts** over one authoritative catalog in Scripthold `3.1.6`.\n- **168 registered encodings**, including UTF-32 LE/BE and broad portable legacy coverage; automatic detection remains intentionally more conservative than explicit codec support.\n- **101 active source-intelligence providers** across programming languages, dialects, DSLs, document/config formats, and composites, with capability-specific evidence and fail-closed ambiguity.\n- **Secure filesystem boundaries** with resolved-root containment, deterministic traversal, Windows reparse/junction handling, staged mutation, conflict detection, and no-replace creation.\n- **Verified change workflows** with deterministic fingerprints, one-shot edit approval, strict patch packages, persistent backup integration, and typed verification.\n- **Offline backup recovery** with deterministic persisted review plans, immutable source evidence, fully verified reconstruction into a separate staged destination, mandatory full audit, no-replace promotion, and path-free provenance.\n- **Durable asynchronous execution** with idempotent admission, an owner-only task store, bounded queue/logs, independent supervisor/worker/executor lifecycle, recovery, logical locks, and cancellation.\n- **Fail-closed Streamable HTTP** with bearer authentication, loopback defaults, exact Host/Origin checks, bounded resources, no CORS, and explicit TLS/proxy requirements for non-loopback exposure.\n\n**Scripthold was built with Scripthold.**\n\n> **Lineage:** Scripthold originated from the [original `mcp-file-tools` project](https://github.com/dimitar-grigorov/mcp-file-tools), created by **Dimitar Grigorov**, and retains its GPL-3.0 lineage and permanent attribution. See [Project Direction](docs/PROJECT_DIRECTION.md).\n\n## Current release and development state\n\n**Scripthold `3.1.6`** is the current public release. It exposes 36 tools, 3 guided prompts, 168 registered encodings, and 101 active source-intelligence providers over the same stdio and Streamable HTTP surface. `source_symbols` provides bounded declaration/navigation workflows; `source_query` adds structural search, supported project relations, fingerprint-verified context, and coherent process-local index generations. Capability claims remain provider-specific and fail closed where evidence is insufficient.\n\nR1-R28 and the subsequent pre-R29 verification-architecture maintenance program are complete. No release-scoped milestone is currently active; R29-R33 remain planned. See [CHANGELOG.md](CHANGELOG.md) for release changes, [docs/ROADMAP.md](docs/ROADMAP.md) for current/future work, [docs/ROADMAP_HISTORY.md](docs/ROADMAP_HISTORY.md) for concise engineering history, and the subsystem contracts for detailed behavior.\n\n## Quality and security\n\nThe push-event [Test Suite](.github/workflows/test.yml) is the exact-commit release-candidate gate. It covers Windows/Linux/macOS native regression and race testing, Go vet, standalone Staticcheck, the repository's focused `golangci-lint` policy, govulncheck, deterministic fuzz checks, six supported-target cross-builds, workflow/shell validation, and native/container smoke before the aggregate `Release candidate` job can pass.\n\n[CodeQL](.github/workflows/codeql.yml) adds Go code scanning on `main` pushes, a weekly schedule, and manual runs. Vulnerability reporting and responsible-disclosure guidance are in [SECURITY.md](SECURITY.md). Secret scanning, allowed-root confinement, durable mutation/backup invariants, encoding safety, and transport security remain part of the repository's normal verification model rather than badge-only claims.\n\n## Transport and authorization model\n\n| Transport | Typical use | Security boundary | Roots behavior |\n|---|---|---|---|\n| stdio | Local MCP clients and secure tunnel bridges | Client configuration plus operating-system process boundary | Startup directories are authoritative; dynamic client roots are accepted only when startup roots are empty |\n| Streamable HTTP | Persistent localhost services, containers, trusted proxies, explicitly secured remote services | Bearer token on every MCP request; loopback by default; TLS or trusted proxy boundary for non-loopback | Startup directories are immutable and shared by all requests; HTTP clients cannot mutate roots |\n\nBoth transports use the same `BuildServer` path and expose the same tools, prompts, limits, encoding behavior, error model, and execution policy.\n\nAllowed directories are a **process-wide authorization boundary**. Sessions separate protocol lifecycle and cancellation; they are not per-agent filesystem ACLs. If two agents require technical isolation, run separate Scripthold processes with narrower roots and, for concurrent Git writes, separate checkouts or worktrees.\n\nMCP `2026-07-28` is supported through the stable Go SDK. Native HTTP serves stateless modern requests beside retained stateful legacy sessions under the same outer authentication, Host/Origin, resource, logging, and execution controls. See [docs/MCP_2026_07_28_ADOPTION.md](docs/MCP_2026_07_28_ADOPTION.md) and [docs/HTTP_SECURITY.md](docs/HTTP_SECURITY.md).\n\n## Tool catalog\n\n### File and directory operations\n\n- [`read_text_file`](TOOLS.md#read_text_file) — stream decoded text with bounded output and optional line numbers.\n- [`read_multiple_files`](TOOLS.md#read_multiple_files) — deterministic bounded batch reads with per-file status.\n- [`write_whole_file`](TOOLS.md#write_whole_file) — replace complete file contents through the shared encoder.\n- [`edit_file`](TOOLS.md#edit_file) — read-only exact edit preview with approval fingerprints and a one-shot capability.\n- [`edit_file_apply`](TOOLS.md#edit_file_apply) — apply only the exact prepared edit identified by `previewId`.\n- [`patch_package`](TOOLS.md#patch_package) — read-only inspect/dry-run/verify for declared multi-file edits.\n- [`patch_package_apply`](TOOLS.md#patch_package_apply) — apply only a prepared patch-package capability.\n- [`list_directory`](TOOLS.md#list_directory) — list directory entries with filtering and deterministic sorting.\n- [`tree`](TOOLS.md#tree) — compact `.gitignore`-aware deterministic tree output.\n- [`get_file_info`](TOOLS.md#get_file_info) — read file or directory metadata.\n- [`filesystem_package`](TOOLS.md#filesystem_package) — read-only bounded preparation for coordinated no-replace create/copy/move/delete filesystem changes.\n- [`filesystem_package_apply`](TOOLS.md#filesystem_package_apply) — apply one prepared filesystem package by one-shot `previewId`.\n- [`search_files`](TOOLS.md#search_files) — bounded `.gitignore`-aware glob search.\n- [`source_symbols`](TOOLS.md#source_symbols) — bounded read-only source `outline`, `digest`, `find`, and fingerprint-bound `show` navigation.\n- [`source_query`](TOOLS.md#source_query) — bounded R27 read-only structural search, supported project relations, and fingerprint-verified task-context assembly.\n- [`fingerprint_paths`](TOOLS.md#fingerprint_paths) — deterministic SHA-256 state fingerprints.\n- [`verify_state`](TOOLS.md#verify_state) — bounded typed JSON/text/Git-diff/fingerprint checks.\n- [`backup_store`](TOOLS.md#backup_store) — read-only status/history/compare/audit plus restore/GC preparation for the optional persistent store.\n- [`backup_restore_apply`](TOOLS.md#backup_restore_apply) — apply one prepared original-target restore.\n- [`backup_gc_apply`](TOOLS.md#backup_gc_apply) — apply one prepared generation-bound backup GC plan.\n- [`grep_text_files`](TOOLS.md#grep_text_files) — paged regex search with deterministic partial-coverage reporting.\n### Encoding and service tools\n\n- [`detect_encoding`](TOOLS.md#detect_encoding) — conservative encoding detection with confidence or explicit ambiguity.\n- [`convert_encoding`](TOOLS.md#convert_encoding) — read-only exact single/batch conversion preview.\n- [`convert_encoding_apply`](TOOLS.md#convert_encoding_apply) — apply a prepared exact conversion by `previewId`.\n- [`detect_line_endings`](TOOLS.md#detect_line_endings) — bounded LF/CRLF/mixed analysis.\n- [`change_line_endings`](TOOLS.md#change_line_endings) — line-ending conversion while preserving encoding/BOM semantics.\n- [`manage_bom`](TOOLS.md#manage_bom) — detect BOM state or prepare an exact add/strip change.\n- [`manage_bom_apply`](TOOLS.md#manage_bom_apply) — apply one prepared BOM mutation by `previewId`.\n- [`list_encodings`](TOOLS.md#list_encodings) — authoritative runtime encoding inventory.\n- [`list_allowed_directories`](TOOLS.md#list_allowed_directories) — report process-authorized roots.\n- [`check_for_updates`](TOOLS.md#check_for_updates) — notification-only fork release check.\n### Durable task execution\n\n- [`task_run`](TOOLS.md#task_run) — durably enqueue idempotent shell or script work.\n- [`task_list`](TOOLS.md#task_list) — page/filter persistent task metadata.\n- [`task_get`](TOOLS.md#task_get) — inspect current/terminal task state and bounded lifecycle history.\n- [`task_logs`](TOOLS.md#task_logs) — read bounded stdout/stderr with absolute cursors.\n- [`task_cancel`](TOOLS.md#task_cancel) — cancel queued work or terminate a running process tree.\n\nThe detailed schemas, outputs, limits, and examples are authoritative in [TOOLS.md](TOOLS.md). `internal/toolcatalog/catalog.json` is the source of truth for runtime tool metadata.\n\n### Encoding support\n\n`list_encodings` is authoritative for canonical names, aliases, and capability metadata. Scripthold `3.1.6` exposes 168 canonical read/write encodings across Unicode, IBM/DOS/EBCDIC, ISO-8859, Windows, classic Mac/KOI8/other single-byte families, and East Asian/stateful multibyte families.\n\nThe production runtime remains pure Go. Additional mappings and state machines derived from pinned GNU libiconv evidence are checked in and require no libiconv/GCC dependency during ordinary build or execution. UTF-32 LE/BE are full text encodings with strict scalar validation; generic byte-order-unspecified `utf-32` remains intentionally rejected. See [docs/GLOBAL_ENCODING_COVERAGE.md](docs/GLOBAL_ENCODING_COVERAGE.md) for the completed R22 contract.\n\n## Installation\n\nChoose **stdio** when the MCP client should own the child process or a secure bridge expects a local command. Choose **Streamable HTTP** for a persistent authenticated service. Both expose the same public behavior.\n\n### Use a published release\n\nScripthold-named releases use raw binary names of the form `scripthold_<os>_<arch>` (with `.exe` on Windows) and matching platform archives. Historical `2.0.0` predates the rename and retains its original asset names.\n\nFor reproducible installations, use a specific semantic release rather than `@main` or an assumed historical asset name. Verify the published asset against `checksums.txt` before installation.\n\n### Build from source\n\n```bash\ngit clone https://github.com/zoster81/scripthold.git\ncd scripthold\ngo test ./...\ngo build -o scripthold ./cmd/scripthold\n```\n\nThe module path is `github.com/zoster81/scripthold`.\n\n### Local stdio clients\n\nPass every startup-authorized directory as an argument:\n\n```json\n{\n  \"mcpServers\": {\n    \"scripthold\": {\n      \"type\": \"stdio\",\n      \"command\": \"C:\\\\Tools\\\\scripthold_windows_amd64.exe\",\n      \"args\": [\"D:\\\\Projects\"]\n    }\n  }\n}\n```\n\nA roots-capable stdio client may provide dynamic roots only when the process starts without directory arguments. `MCP_STDIO_LEGACY_HANDSHAKE=1` exists only for legacy bridges that probe discovery and repeat an equivalent legacy initialization on one persistent child; leave it disabled for normal modern clients.\n\n### Native Streamable HTTP\n\nHTTP requires exactly one bearer-token source. A minimal loopback PowerShell start is:\n\n```powershell\n$tokenPath = Join-Path $env:TEMP \"scripthold.token\"\n$bytes = New-Object byte[] 32\n$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()\ntry { $rng.GetBytes($bytes) } finally { $rng.Dispose() }\n[System.IO.File]::WriteAllText($tokenPath, [Convert]::ToBase64String($bytes), [System.Text.UTF8Encoding]::new($false))\n\n$env:MCP_HTTP_TOKEN_FILE = $tokenPath\n$env:MCP_HTTP_ADDR = \"127.0.0.1:8765\"\n.\\scripthold_windows_amd64.exe --transport=streamable-http D:\\Projects\n```\n\nThe MCP endpoint is `http://127.0.0.1:8765/mcp`; `/healthz` and `/readyz` expose minimal liveness/readiness status. The token must be sent as `Authorization: Bearer <token>` on every MCP request. Do not put tokens in command-line arguments, URLs, cookies, or query parameters.\n\nNon-loopback listeners require explicit opt-in plus TLS or an explicitly trusted proxy boundary. Browser CORS is not enabled. See [docs/HTTP_SECURITY.md](docs/HTTP_SECURITY.md) before exposing HTTP beyond loopback.\n\n### OpenAI Secure MCP Tunnel\n\nThe repository includes sanitized PowerShell examples for tunnel and local topologies:\n\n| Example | Topology |\n|---|---|\n| [`start-local-stdio.ps1`](examples/start-local-stdio.ps1) | One foreground local stdio server. |\n| [`start-local-http.ps1`](examples/start-local-http.ps1) | One authenticated HTTP server; loopback by default. |\n| [`start-openai-tunnel-stdio-plus-local-http.ps1`](examples/start-openai-tunnel-stdio-plus-local-http.ps1) | Tunnel to a dedicated stdio child plus an independent local HTTP process. |\n| [`start-openai-tunnel-http-plus-local-stdio.ps1`](examples/start-openai-tunnel-http-plus-local-stdio.ps1) | Tunnel to authenticated HTTP plus an independent local stdio child. |\n\nCopy an example outside the Git checkout before replacing placeholders. Never commit Runtime API keys, Tunnel IDs, bearer tokens, or private state paths. The tunnel setup uses OpenAI's official [`tunnel-client`](https://github.com/openai/tunnel-client); consult the official client documentation for current OpenAI control-plane requirements.\n\nThe example launchers keep `task_run` execution disabled by default. Script and shell execution remain separate authorizations, and HTTP additionally requires `MCP_HTTP_ENABLE_EXECUTION=1`.\n\n### Container image\n\nThe repository Dockerfile builds a statically linked binary and runs as unprivileged UID/GID `10001`. The image is transport-neutral.\n\n```bash\ndocker build --build-arg VERSION=dev -t scripthold:dev .\n\ndocker run --rm -i \\\n  --read-only \\\n  --cap-drop=ALL \\\n  --security-opt=no-new-privileges \\\n  --tmpfs /tmp:rw,noexec,nosuid,size=64m \\\n  --mount type=bind,source=/absolute/project,target=/data \\\n  scripthold:dev --transport=stdio /data\n```\n\nThe mounted directory must be accessible to UID/GID `10001`. HTTP containers should mount token/TLS files read-only, publish only the intended port, and preserve the security contract in [docs/HTTP_SECURITY.md](docs/HTTP_SECURITY.md).\n\n## Security model\n\n- File tools access only explicitly authorized roots after canonical path resolution.\n- Recursive operations do not follow escaping symlinks, junctions, or other reparse points.\n- Mutations stage and revalidate before commit; initially missing destinations use no-replace creation. Single-file mutators classify the bounded actual target state after failures that may occur beyond the commit boundary instead of reporting preview-predicted changes as fact.\n- Failed MCP tool calls preserve stable error metadata/text; tools with structured output also expose `errorCode` and human-readable `message` there, retaining any existing partial-state evidence.\n- The optional backup store must be a separate non-overlapping owner-only authority and is inaccessible to ordinary file tools.\n- `task_run` is disabled by default. Script tasks validate/fingerprint the script and execute an owner-only matching snapshot; shell tasks validate the logical shell name before durable admission, confine only the working directory, and otherwise run with the executor identity's operating-system permissions.\n- HTTP adds authentication, Host/Origin, proxy/TLS, resource, logging, and execution boundaries; it is not a replacement for operating-system isolation.\n\nDetailed contracts: [HTTP security](docs/HTTP_SECURITY.md), [verified changes](docs/VERIFIED_CHANGE_WORKFLOWS.md), [persistent backups](docs/PERSISTENT_BACKUP_LIFECYCLE.md), [offline backup diagnostics](docs/OFFLINE_BACKUP_DIAGNOSTICS.md), [R23 mutation surface](docs/MCP_MUTATION_SURFACE.md), [R24 safe filesystem operations](docs/SAFE_FILESYSTEM_OPERATIONS.md), [R25 source intelligence](docs/SOURCE_INTELLIGENCE.md), [R26 backup recovery](docs/BACKUP_RECOVERY.md), and [durable tasks](docs/DURABLE_TASKS.md).\n\n## Configuration\n\nThe most important process-wide variables are summarized below. Subsystem documents contain the precise security and lifecycle semantics.\n\n| Variable | Purpose | Default |\n|---|---|---|\n| `MCP_TRANSPORT` | `stdio` or `streamable-http`; CLI `--transport` takes precedence. | `stdio` |\n| `MCP_DEFAULT_ENCODING` | Encoding for newly created files when no encoding is supplied. | `utf-8` |\n| `MCP_MAX_FILE_BYTES` | Full-document source-size limit. | `67108864` |\n| `MCP_MAX_DECODED_CHARACTERS` | Maximum decoded characters returned by `read_text_file`. | `16777216` |\n| `MCP_MAX_LINE_BYTES` | Maximum decoded UTF-8 bytes in one line. | `16777216` |\n| `MCP_MAX_BATCH_FILES` | Maximum items in bounded batch/path-list operations. | `256` |\n| `MCP_MAX_MATCHES` | Server maximum for grep matches. | `10000` |\n| `MCP_MAX_OUTPUT_BYTES` | Aggregate structured/text output budget. | `67108864` |\n| `MCP_SOURCE_MAX_FILES` | R25 source files considered per request before stricter global ceilings. | `256` |\n| `MCP_SOURCE_MAX_AGGREGATE_BYTES` | Aggregate raw source bytes selected by one source-intelligence request. | `67108864` |\n| `MCP_SOURCE_MAX_FILE_BYTES` | Per-file source-intelligence byte ceiling. | `8388608` |\n| `MCP_SOURCE_MAX_SYMBOLS` | Retained source-symbol ceiling per request/analyzer budget. | `10000` |\n| `MCP_SOURCE_MAX_CONCURRENCY` | Bounded source-analysis worker count. | `4` |\n| `MCP_SOURCE_MAX_REQUEST_SECONDS` | Source-intelligence request deadline. | `30` |\n| `MCP_SOURCE_MAX_OUTPUT_BYTES` | Source-intelligence structured output budget before the global output ceiling. | `16777216` |\n| `MCP_SOURCE_MAX_RESULTS` | R27 retained search/relation result ceiling. | `10000` |\n| `MCP_SOURCE_MAX_GRAPH_NODES` | R27 graph-node ceiling. | `5000` |\n| `MCP_SOURCE_MAX_GRAPH_EDGES` | R27 graph-edge ceiling. | `20000` |\n| `MCP_SOURCE_MAX_GRAPH_DEPTH` | R27 graph traversal depth ceiling. | `8` |\n| `MCP_SOURCE_MAX_CONTEXT_BYTES` | R27 task-context byte budget. | `1048576` |\n| `MCP_SOURCE_MAX_CONTEXT_ITEMS` | R27 retained context-item ceiling. | `256` |\n| `MCP_SOURCE_MAX_INDEX_PROJECTS` | R27 retained process-local index-scope ceiling. | `4` |\n| `MCP_SOURCE_MAX_INDEX_GENERATIONS` | R27 retained generations per index scope. | `2` |\n| `MCP_MAX_FILESYSTEM_PACKAGE_OPERATIONS` | Maximum operations in one `filesystem-package-v1` manifest. | `256` |\n| `MCP_MAX_FILESYSTEM_PACKAGE_BYTES` | Maximum prepared filesystem-package manifest size. | `16777216` |\n| `MCP_MAX_FILESYSTEM_RECURSIVE_ENTRIES` | Maximum entries in one exact recursive copy/delete scope. | `100000` |\n| `MCP_MAX_FILESYSTEM_RECURSIVE_DEPTH` | Maximum exact recursive copy/delete depth. | `128` |\n| `MCP_MAX_FILESYSTEM_AGGREGATE_BYTES` | Maximum aggregate source bytes in one filesystem package. | `1073741824` |\n| `MCP_MAX_FILESYSTEM_STAGING_BYTES` | Maximum aggregate bytes staged before filesystem-package commit. | `1073741824` |\n| `MCP_MAX_FILESYSTEM_PACKAGE_PREVIEWS` | Maximum retained filesystem-package preview capabilities. | `16` |\n| `MCP_MAX_FILESYSTEM_PACKAGE_PREVIEW_BYTES` | Maximum aggregate retained preview state. | `134217728` |\n| `MCP_FILESYSTEM_PACKAGE_PREVIEW_TTL_SECONDS` | Filesystem-package preview lifetime. | `900` |\n| `MCP_MEMORY_THRESHOLD` | Deprecated fallback for file/output byte limits. | unset |\n| `MCP_HTTP_ADDR` | HTTP listen address. | `127.0.0.1:8765` |\n| `MCP_HTTP_PATH` | MCP endpoint path. | `/mcp` |\n| `MCP_HTTP_TOKEN_FILE` / `MCP_HTTP_TOKEN` | Mutually exclusive HTTP bearer-token sources. | unset |\n| `MCP_HTTP_ALLOWED_HOSTS` | Additional exact Host values. | listener-derived |\n| `MCP_HTTP_ALLOWED_ORIGINS` | Exact accepted Origin values; no CORS headers are emitted. | empty |\n| `MCP_HTTP_ALLOW_NON_LOOPBACK` | Required opt-in for non-loopback binding. | disabled |\n| `MCP_HTTP_TLS_CERT_FILE` / `MCP_HTTP_TLS_KEY_FILE` | Direct HTTPS certificate/key pair. | unset |\n| `MCP_HTTP_TRUSTED_PROXY_CIDRS` | Immediate trusted proxy networks. | empty |\n| `MCP_HTTP_MAX_BODY_BYTES` | Per-POST body limit. | `16777216` |\n| `MCP_HTTP_MAX_INFLIGHT_BODY_BYTES` | Aggregate concurrent POST-body reservation. | `67108864` |\n| `MCP_HTTP_MAX_CONCURRENT_REQUESTS` | Concurrent non-SSE HTTP handlers. | `64` |\n| `MCP_HTTP_SESSION_TIMEOUT` | Legacy stateful session idle timeout. | `15m` |\n| `MCP_HTTP_ENABLE_EXECUTION` | Additional HTTP-only execution gate. | disabled |\n| `MCP_BACKUP_STORE_DIR` | Enables the dedicated persistent backup store. | unset |\n| `MCP_BACKUP_DEFAULT_POLICY` | Default persistent pre-state policy for approval-bound edit/package/BOM/encoding mutations: `disabled` or `required`. | `disabled` |\n| `MCP_TASK_STORE_DIR` | Enables the owner-only durable task registry. | unset |\n| `MCP_ENABLE_RUN_SCRIPT` | Authorizes `task_run kind=script`. | disabled |\n| `MCP_ENABLE_SHELL` | Authorizes unrestricted `task_run kind=shell`. | disabled |\n| `MCP_ENABLE_EXECUTION` | Authorizes both task kinds. | disabled |\n\nBackup limits, task-store limits, edit/package preview limits, and the full HTTP configuration contract are documented in [docs/PERSISTENT_BACKUP_LIFECYCLE.md](docs/PERSISTENT_BACKUP_LIFECYCLE.md), [docs/DURABLE_TASKS.md](docs/DURABLE_TASKS.md), [TOOLS.md](TOOLS.md), and [docs/HTTP_SECURITY.md](docs/HTTP_SECURITY.md).\n\n## Typical uses\n\n- Read and safely modify legacy source/configuration files without changing their encoding accidentally.\n- Search mixed-encoding repositories with explicit partial-coverage evidence.\n- Navigate heterogeneous repositories across 101 active source providers, query supported project relations, and assemble bounded source context without loading complete projects into the model.\n- Preview and approve edits or multi-file patch packages against deterministic fingerprints.\n- Keep approval-bound persistent backups and restore a selected original target safely.\n- Recover trustworthy records from a damaged backup store offline into a separate audited destination without modifying the source evidence.\n- Run long builds/tests through durable tasks without tying process lifetime to one MCP request.\n- Serve the same workspace tools through local stdio, authenticated HTTP, containers, or a secure tunnel bridge.\n\nExample:\n\n```text\nUser: Read config.ini and change the title to \"Настройки\".\nAssistant: read_text_file (cp1251) -> edit_file preview preserving cp1251 -> explicit approval -> edit_file_apply(previewId)\n```\n\n## Development and contribution\n\nPrerequisite Go version is declared by `go.mod`. The full local quality gate also uses the repository-pinned `golangci-lint` policy.\n\n```bash\ngo mod verify\ngo test ./...\ngolangci-lint run ./...\ngo build -o scripthold ./cmd/scripthold\n```\n\nContributor workflow is in [CONTRIBUTING.md](CONTRIBUTING.md). Coding agents should read the root [AGENTS.md](AGENTS.md) and the nearest scoped guide. Reusable verification is in [docs/DEVELOPMENT_CHECKLIST.md](docs/DEVELOPMENT_CHECKLIST.md), current planning in [docs/ROADMAP.md](docs/ROADMAP.md), and publication in [docs/PUBLISHING.md](docs/PUBLISHING.md).\n\nThe intentional 1.8-to-2.0 breaking changes remain documented in [docs/MIGRATION_2.0.md](docs/MIGRATION_2.0.md). The Scripthold `3.0.0` R23-R27 surface evolution is documented in [docs/MIGRATION_3.0.md](docs/MIGRATION_3.0.md) and the completed subsystem contracts.\n\n## License\n\nGPL-3.0 — see [LICENSE](LICENSE).\n",
  "bytes": 25949,
  "sha": "607c8029378d9b0bb31f0571f161cc967f65cb3f965d950ac4d2c780f63bc7c3",
  "repo_slug": "zoster81/scripthold",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_zoster81_scripthold_a9d7a519/readme"
}