A local MCP server that lets Claude on the web, ChatGPT, and Grok read/write files and run a whitelisted shell on your machine over HTTPS/OAuth 2.1, via Tailscale Funnel by default.

Does aki-mcp-sv require Node.js?

Not necessarily — the recommended path is downloading the standalone launcher for your OS, which already bundles its own Node runtime. Installing from source (npm install) is an alternative if you already have Node.js.

Is aki-mcp-sv safe to expose to the internet?

The shell tool uses a whitelist rather than a blocklist, read-only by default, executed via execFile which blocks shell injection. The control panel binds to localhost only and is never exposed through Funnel.

How is aki-mcp-sv different from Claude Desktop?

Claude Desktop ties usage to a fixed device ID; aki-mcp-sv lets you switch between multiple accounts just by switching browser profiles, all pointed at the same machine, using web/Pro quota instead of per-token API billing.

Yes, released under the MIT License, source available at github.com/lacvietanh/aki-mcp-sv.

What Is aki-mcp-sv? Local File and Shell Access for Claude Web

What Is aki-mcp-sv?

aki-mcp-sv is an MCP (Model Context Protocol) server that runs on your own machine, built by Lac Viet Anh, giving Claude on the web (claude.ai), ChatGPT, and Grok read/edit access to files and a whitelisted shell — not through the API, no desktop app, no Claude Desktop install required. It connects over HTTPS authenticated with OAuth 2.1, through a swappable public edge (Tailscale Funnel by default, or your own Cloudflare tunnel, or any stable HTTPS edge you run yourself). Gemini support is experimental.

Why aki-mcp-sv Exists

claude.ai's web/Pro quota is far cheaper than paying per token through the API for equivalent work. But most real work is project work: reading, editing, and running commands against actual files on your machine, not open-ended chat. Claude Desktop already has local file access, but ties usage to a device ID you don't control, and running multiple accounts means repeated login/logout. aki-mcp-sv routes around both problems: run an MCP server on your machine, expose it over HTTPS via Tailscale Funnel, and connect it to claude.ai as a custom connector — switching browser profiles is enough to pick up a different account, all pointed at the same machine, with no device lock-in.

When to Use aki-mcp-sv

At your desk: a native Terminal/CLI (Claude Code, Antigravity CLI, Cursor) is still faster and more fluid — use that instead.
Away from your desk (mobile, a browser, or a machine that isn't yours): use aki-mcp-sv via Claude Web, ChatGPT Mobile, or Grok to check on a running job, read logs, clean up temp files, or pull the latest code on your home/office machine.
On a schedule, with nobody watching: pair Grok's scheduled prompts with aki-mcp-sv for cloud-triggered local execution.

Install Without Node.js

The recommended path is downloading the standalone launcher for your OS from the latest release (not GitHub's green "Download ZIP" button, which is just the source and won't run):

macOS: double-click aki-mcp-sv-<version>-macos.command.
Linux: chmod +x aki-mcp-sv-<version>-linux.run && ./aki-mcp-sv-<version>-linux.run.
Windows: double-click aki-mcp-sv-<version>-windows.cmd (still needs Git for Windows or WSL on PATH).

The launcher extracts a private Node runtime and the app payload into your OS's standard per-user app-data directory (e.g. ~/Library/Application Support/aki-mcp-sv on macOS); your own settings/tokens live separately at ~/.aki/mcpsv/. Nothing is installed system-wide, no background service or daemon is created, and no admin privileges are required. Closing the terminal window stops the server completely.

Architecture: From claude.ai to Your Machine

A request from Claude web travels through Tailscale Funnel to gatekeeper.js (the single public port, handling OAuth 2.1 and metadata discovery), into mcp-hub which only listens on loopback, then out to the filesystem server (reads/writes inside your granted folders) and a set of in-house local__* tools (find files, search content, run a whitelisted shell command, call the Antigravity CLI in read-only plan mode, read via Kiro CLI). The control panel binds only to 127.0.0.1 and is never exposed through Funnel.

Security: Whitelist, Not Blocklist

The core difference from other popular MCP terminal servers (like Desktop Commander, which uses a blocklist for Claude Desktop) is that aki-mcp-sv chose a whitelist from the start, because this server is exposed to Claude on the web — the open internet. The default command set is read-only, hand-written in shell-mcp.js, executed via execFile (never through a shell, blocking ; & |). Flag-rich binaries whose own flags could escape read-only, like find -delete or sort -o, are deliberately kept out of the default whitelist, so a default connector can't write, delete, or execute anything beyond it. Adding a write command (like git commit) to the whitelist is a deliberate decision and your own responsibility.

The default allowed root is your entire home directory ($HOME) — meaning Desktop, Documents, Downloads, Photos, everything under it, not just the projects you meant to share. You can add/remove folders from the control panel. ~/.claude is also granted at the folder level so claude.ai can read your CLAUDE.md and rule router the same way Claude Code does — this row is locked in the panel (no delete button) so it can't be revoked by accident; removing it requires editing the config file directly.

Connecting From Claude Web, ChatGPT, Grok

Claude web uses a pre-issued client ID/secret (Settings → Connectors → Add custom connector), confirmed with a passphrase shown right in the panel. ChatGPT uses Dynamic Client Registration (DCR) — requires enabling Developer mode and pointing the Registration URL at the exact value the panel prints. Grok is verified working reliably over DCR, the same as ChatGPT. Gemini is experimental: the OAuth handshake succeeds, but tool invocation is not yet reliable.