Installation

Build secure-mcp locally, authorize repository roots, and connect the stdio MCP server to Claude, Cursor, Codex, or another client.

Installation

secure-mcp runs as a local subprocess over stdio. The client launches the built entrypoint, passes a filesystem allowlist in the environment, and exchanges MCP messages over stdin/stdout.

Requirements

Node.js 20 or newer
pnpm preferred (npm also works)
A local checkout of the server

Build the server

pnpm install
pnpm build

The compiled entrypoint is dist/index.js.

Authorize repository roots

Filesystem tools fail closed unless SECURE_MCP_ALLOWED_ROOTS names one or more roots that may contain a requested project_root:

export SECURE_MCP_ALLOWED_ROOTS=/absolute/path/to/repositories

Use : between multiple roots on macOS/Linux and ; on Windows. Keep the scope as narrow as practical; canonical-path and symlink checks still apply within each authorized root.

Connect a client

Point your MCP client at the built entrypoint and pass the allowlist. Claude Desktop and Claude Code use a configuration shaped like this:

{
  "mcpServers": {
    "secure-mcp": {
      "command": "node",
      "args": ["/absolute/path/to/secure-mcp/dist/index.js"],
      "env": {
        "SECURE_MCP_ALLOWED_ROOTS": "/absolute/path/to/repositories"
      }
    }
  }
}

Cursor and other stdio clients use the same command, args, and env values. The project_root supplied to a tool must be visible to the machine running the server, fall under an allowed root, and is safest as an absolute path.

Development loop

pnpm dev
pnpm test
pnpm verify

pnpm dev runs the MCP server through tsx; it is a stdio process, so logs belong on stderr and the terminal may look quiet while the client is connected.