ckanthony/Chisel

🪛 Rust powered precision file operations for agents. Unix-native tools, minimal context footprint, strict path confinement: use directly with Chisel MCP or bring your own MCP, embeddable in any MCP server in Rust, Python, Nodejs.
https://github.com/user-attachments/assets/af84f1af-db47-4e42-808b-00861504cd34
**Install** — download a pre-built .mcpb bundle (one-click, no build step) or a raw binary from the Releases page — see Standalone usage below.
---
> **Agent skill included** — skills/chisel/SKILL.md teaches agents how to use Chisel at maximum efficiency. Install with: npx skills add ckanthony/Chisel
> **Security hardened** — Verified properties across two layers: the MCP server (chisel) and the portable core library (chisel-core). See the Security model section for the full breakdown.
---
Contents
- Motivation
- Tools
- Standalone usage
- Binary
- Docker
- Configure your MCP client
- Behind a reverse proxy
- Bring your own MCP
- Extending chisel
- Workspace layout
- Security model
- Platform support
- Development
- Contributing
- Future considerations
---
Motivation
Most MCP file tools hand an LLM a blank canvas: read anything, write anything, make any mistake. Chisel takes the opposite approach:
- **Reduce context overhead** — every tool call is compact. File edits go through patch_apply: the model sends only a unified diff instead of rewriting an entire file, so large-file edits cost a fraction of the tokens
- **Familiar command patterns** — shell_exec exposes the same Unix tools (grep, sed, awk, find, cat, …) LLMs already know well from training data, so prompts stay short and outputs are predictable
- **Precision over flexibility** — a fixed whitelist and strict path confinement mean the model cannot accidentally escape scope or run arbitrary commands
- **Safety first** — bearer-token auth, 127.0.0.1-only binding, symlink-aware root confinement, atomic writes, and a read-only mode are all on by default
- **Reusable core** — chisel-core is a plain synchronous Rust library; any MCP server (Rust, Node.js via WASM, Python via WASM) can embed it without running a second process
Real-world demo
Six tasks on the same markdown file. Left: typical MCP file server. Right: chisel.
**File:** docs/api.md — 300 lines, 6 headers, one section of ~20 lines.
---
**Task 1 — find all headers**
**Task 2 — read the content under ## Endpoints**
**Task 3 — edit one line in that section**
**Task 4 — replace all - with : in that section**
**Task 5 — model tries to run rm -rf ~**
> rm, bash, sh, curl, chmod, sudo — none of these are in the whitelist.
> The list is fixed at compile time; it cannot be extended at runtime by the model.
**Task 6 — model tries to edit /Users/home/.ssh/config directly**
> Every path — including those passed to shell_exec — is validated against the
> configured root before any I/O or process spawn. An absolute path outside root
> is always rejected, regardless of which tool is called.
---
Context cost comparison
Estimates use **Claude Sonnet 4.6** tokenisation: typical source code averages **~10 tokens/line** (identifiers, punctuation, and whitespace each count as tokens under BPE).
**Single edit — 500-line file, 5 lines changed:**
| | Naive (read_file → write_file) | Chisel (patch_apply) | Reduction |
| ------------------------- | ----------------------------------------- | ---------------------------------- | --------- |
| Tokens in (upload) | ~5 000 (full file) | ~120 (11 diff lines + headers) | **42×** |
| Tokens out (model output) | ~5 000 (full file rewrite) | ~15 (success ack) | **333×** |
| **Round-trip total** | **~10 000** | **~135** | **~74×** |
| Failure mode | Silent hallucination corrupts entire file | PatchFailed — original untouched | — |
**Read / search — 2 000-line file:**
| Task | Naive (read_file full) | Chisel (shell_exec) | Reduction |