io.github.open-mcp-ai/termcp

⚡ Termcp

English | 中文

Let AI into your terminals

Lightweight AI-native secure terminal: visual multi-surface, MCP + SKILLS + API

• Human and agent, equal — both write to the same terminal, and you see every screenful as it happens; take over, switch, collaborate.
• Fine-grained session control — file management, port forwarding, multi-terminal multiplexing, terminal read/write access.
• Dependency-free install — a single ~10 MB file, multi-platform, with npx integration.

Install

1 · One command per agent

2 · Or this config file

{
  "mcpServers": {
    "termcp": {
      "command": "npx",
      "args": ["-y", "@open-mcp-ai/termcp", "daemon", "stdio"]
    }
  }
}

That command is the whole server: it starts the background instance on first use, relays MCP over stdin/stdout, and the instance exits on its own once idle. Ready to go as-is.

Other install methods — npm / Go / Docker / prebuilt binary

The npm wrapper downloads the matching prebuilt binary (override with TERMCP_VERSION, TERMCP_MIRROR, TERMCP_BIN, TERMCP_SKIP_DOWNLOAD). Flags: docs/cli.md. Docker recipes, Compose and a token-free loopback setup: docs/deploy.md.

HTTP transport, when an instance is already answering somewhere (npx -y @open-mcp-ai/termcp):

{
  "mcpServers": {
    "termcp": {
      "type": "http",
      "url": "http://localhost:18765/stream"
    }
  }
}

Reachable from a client in Docker as http://host.docker.internal:18765/stream (macOS/Windows) or the host's LAN IP; from another container on the same network as http://termcp:18765/stream. Legacy SSE uses http://localhost:18765/sse — only /sse, JSON-RPC goes to /message by itself. With --auth-token, add a bearer header: "headers": {"Authorization": "Bearer <token>"}.

Preview

Open http://127.0.0.1:18765 — every agent session appears here.

A shell's timeline marks each line by its source — green shell output, yellow your input, pink the agent's. At sudo, a password, MFA or [Y/n], the agent calls notify_user to hand the prompt back to you; you type the secret in the browser, where it stays out of the model's context.

Capabilities

Security Model

• Credentials stay server-side. Passwords, private keys and passphrases written through ssh_config are stored on the host only and never read back; the MCP read interface returns profile names. Profile write tools stay off unless --mcp-manage-ssh-configs is set, and --no-internal narrows agents to remote hosts.
• One token protects every surface. --auth-token, or a salted --auth-hash so the server holds no plaintext — Web UI, REST, both MCP transports and the WebSocket. A non-loopback bind requires it.
• Basic auth is Base64. Terminate TLS in a reverse proxy when serving beyond your own machine; the token is never logged and never placed in a URL.
• 🚨 Do not put an agent on a production host unattended. If you must, turn review mode on. Every write it makes over MCP then waits for a human decision. Review mode is a real gate, not a guarantee: a careless reviewer can still wave a destructive command through.
• What needs a live connection. On a closed (DEAD) session, file and forward tools return session_not_running; output reading keeps working, and the session's port forwards close with it.

Docs

Star History

License

Released under the MIT License. You are free to use, modify, and distribute it, provided the copyright notice and permission notice are retained. Thanks to the linux.do community for the discussions and support.