Conduit

Model Context Protocol · server + host

An MCP server
that refuses.

Conduit exposes a code repository over MCP through four read-only tools — search, read, symbols, diff — behind a boundary that resolves every path before touching disk. Ask it something below and watch the tool calls land. Ask it for a secret and watch the boundary hold.

Tools, discovered from the running server the client hardcodes none of these

  • contacting the server…

The trace

Nothing through the conduit yet.

Pick a question on the left. Every answer you see is built from tool calls, and every tool call is shown — including the ones the server turns down.

What the boundary actually is

Three guarantees, each proven by a test that attempts a violation and asserts it fails. Security tested, not asserted.

  • Repo-root confinement

    Resolves .. and symlinks, then refuses anything landing outside the root — including a sibling directory that merely shares the prefix.

    14 traversal cases →

  • Secrets deny-list

    .env, *.key, *.pem, id_rsa, .git/ are never read, never returned in search results, never listed in the tree.

    Deny-list tests →

  • Read-only posture

    The server refuses to start if a tool outside the allow-set is registered. A static AST scan asserts no server code opens a file for writing or imports subprocess.

    Read-only proof →