aki-mcp-sv
Open Source v1.9.3One npm start command turns a machine into an MCP server so Claude web and ChatGPT can read, edit files and run shell, no desktop app install needed.
github.com/lacvietanh/aki-mcp-sv · Windows · Linux · macOS · MCP · Tailscale Funnel
aki-mcp-sv is an open-source (MIT License) MCP server that exposes a personal machine's filesystem and shell to Claude.ai, ChatGPT, and Grok (Gemini also authenticates, though tool-driving is still being ironed out) over Tailscale Funnel (or an optional Cloudflare tunnel since version 1.7.0), authenticated with OAuth 2.1. No desktop app install, no device-locked quota — and since 1.8.0, the standalone launcher needs no install at all, not even Node.js. Shell access runs through a read-only-by-default whitelist, unlike Desktop Commander's blocklist model. The GitHub repository is the single source of truth.
Option 1: Standalone launcher (recommended — no Node.js needed)
Download the launcher for your OS from the Releases page (not the green “Code → Download ZIP” button above — that's just unrunnable source): macOS opens the .command file, Linux chmod +x then runs the .run file, Windows opens the .cmd (still needs Git for Windows/WSL on PATH). First run downloads the Node runtime + payload with checksum verification; later runs need no network. Keep the terminal window open — it is the running server, closing it stops everything.
Download the launcher from GitHub ReleasesOption 2: Install from source (needs Node.js)
git clone https://github.com/lacvietanh/aki-mcp-sv.git && cd aki-mcp-sv && npm install && npm startRequirements: Node.js, a Tailscale account with Funnel enabled (free on every plan). Windows additionally needs Git for Windows (or WSL) on PATH.
- Runs on Windows, Linux, macOS — a standalone launcher needs no Node.js, or install via git clone + npm install + npm start
- Exposed to the internet over Tailscale Funnel (HTTPS, free on every Tailscale plan)
- Connects Claude.ai, Gemini (pasted client ID/secret) and ChatGPT, Grok (self-register via RFC 7591 DCR) — Claude/ChatGPT/Grok are reliable, Gemini connects but doesn't yet drive tools reliably
- Kiro CLI arm: kiro_read only; kiro_write removed in 1.3.0 — writes via session filesystem MCP
- Deny-by-default shell whitelist + trusted script dirs; find/sort not default
- local__find_path ~0.2s/164k files; local__search_content defaults to -iE regex
- 1.5.0 consolidated 8 tool processes into 4, every arm under one local__* server — existing connectors must reconnect
- Panel: stepper + tabs Claude/Grok/ChatGPT/Gemini, spy-TOC, every value click-to-copy; binds 127.0.0.1
- 1.6.0 checks for new releases of both aki-mcp-sv and AkiDevRule on every npm start
- 1.7.0 lets you swap the public edge: a Cloudflare tunnel (--tunnel) or self-run PUBLIC_ORIGIN, precedence --tunnel > PUBLIC_ORIGIN > Funnel
- MIT — GitHub is source of truth
- Releases 2026-08-07 to 2026-08-16: 1.0.0 → 1.9.3, including a standalone launcher install path (no git/npm) for Windows/macOS/Linux
Core Ideas
Whitelist, not blocklist
Desktop Commander, the most popular MCP terminal server for Claude Desktop, blocks shell commands with a blocklist (deny-listed commands, allow by default) and runs locally over stdio, not designed to be exposed to the internet. aki-mcp-sv does the opposite: nothing runs unless explicitly declared in the allowlist, down to the subcommand (git is scoped to status/log/diff/show only).
gatekeeper.js is the only public door
mcp-hub ships its own unauthenticated admin REST API (/api/*). It only listens on loopback; gatekeeper.js is the sole process receiving Funnel traffic, so that unauthenticated API never touches the internet.
OAuth 2.1: Claude/Gemini paste in, ChatGPT/Grok self-register
claude.ai defaults to attempting Dynamic Client Registration (DCR) first; aki-mcp-sv doesn't advertise that endpoint to Claude, so client_id/client_secret are generated once at npm start and pasted manually into Advanced settings; Gemini reuses that same client. ChatGPT and Grok do the opposite, self-registering via POST /register (RFC 7591) as public clients, each with its own redirect URI. All four still have to clear the passphrase screen and PKCE before getting a token.
Kiro CLI: read-only arm (kiro_write removed)
kiro_read (--trust-tools=fs_read) locks the model to sonnet-4.5; verified against kiro-cli 2.16.2. kiro_write was removed in 1.3.0 as it duplicated the session filesystem write path — file writes go through the connector's filesystem MCP arm.
find_path instead of the default search_files
The default search_files tool doesn't return directories and times out easily on large trees. find_path scans the whole tree in one call, measured at ~0.2s over 164,000 files / 11,700 directories, returns both files and directories, and skips node_modules/.git automatically.
Two layers block unauthorized access
A 10-character passphrase at /authorize (~50 bits of entropy, no bare Approve button since /authorize is a public endpoint), plus PKCE S256 so access tokens only go to the client holding the matching code_verifier.
execFile, never a real shell
shell-mcp.js runs commands via execFile, never through a real shell, so command-chaining characters (; & | `) are blocked at the execution layer rather than by string filtering.
1.7.0: a swappable public edge
From 1.7.0, beside the default Tailscale Funnel you can run through your own Cloudflare tunnel with --tunnel (JSON credentials, --origin supplies the hostname, forward fixed at 9999), or point straight at a self-run HTTPS origin via PUBLIC_ORIGIN. Precedence: --tunnel > PUBLIC_ORIGIN > Funnel. It is an option for regions where Funnel intermittently drops requests, not a claim that Cloudflare is more reliable.
Compared to other remote MCP patterns
| Project | Internet exposure | Auth | Shell model |
|---|---|---|---|
| aki-mcp-sv | Tailscale Funnel, self-hosted | OAuth 2.1 (Claude/Gemini pasted, ChatGPT/Grok DCR) | Whitelist, read-only by default |
| Desktop Commander | None — local stdio | None | Blocklist, allow by default |
| mcp-remote (geelen) | Doesn't expose anything — a client-side bridge | OAuth 2.1 + PKCE + DCR (client side) | None, just a pipe |
| server-filesystem (Anthropic) | None — local stdio/Docker | None | No shell tool at all |
mcp-remote isn't a competing server: it's a client-side bridge that lets stdio-only apps talk to a remote MCP server that already exists elsewhere, and doesn't provide any filesystem or shell access on its own.
Author
Lạc Việt Anh — founder of the Aki ecosystem. aki-mcp-sv distills how he uses Claude web to work on real code, released as open source under the MIT License. Version 1.1.0 (Windows support + the ChatGPT connector) includes a contribution from capybara (okdev888) via PR #1; the 1.2.x line added Gemini, Grok, and the Kiro CLI arm.
aki-mcp-sv belongs to the ecosystem's dev-tooling layer, alongside AkiDevRule and Aki Dev Sync. See more technical write-ups at AkiDEV (dev.akitao.com).
Frequently Asked Questions
What is aki-mcp-sv?
How do I install it?
Why whitelist instead of blocklist for shell?
Is it safe to expose a machine to the internet?
One npm start command. Claude web and ChatGPT reach your machine.
View on GitHub