OthmaneBlial/term_mcp_deepseek

**See the command, risk, workspace, and limits before anything runs. Then keep a signed receipt of what actually happened.**
Term MCP DeepSeek is a local, approval-first terminal control plane for MCP clients and humans. It gives DeepSeek an isolated advisory role while deterministic policy owns command planning, approval, bounded execution, live events, and signed evidence.
**Explore the interactive project website →**
Why this project
Most terminal agents collapse suggestion and execution into one opaque moment. Term MCP DeepSeek makes the boundary visible:
- Model text never executes directly.
- Inspect mode is read-only by default.
- Every command is parsed without a shell and scoped to one workspace.
- Pause, resume, cancel, timeout, output limits, and process isolation are first-class states.
- DeepSeek can be absent or offline without disabling local MCP tools.
- Receipts separate command, stdout, stderr, exit code, signal, permission, and signature.
- Shareable exports remove command text, workspace paths, arguments, and output, then receive a new valid signature.
First result in 60 seconds
Requirements: macOS or Linux, Python 3.10–3.13, and pipx.
The server prints a one-time bearer token. Open http://127.0.0.1:8000, paste that token, choose **Inspect workspace**, then select **Build plan** and **Execute**.
Expected result: the UI shows a low-risk pwd plan before execution, then a succeeded receipt with exit code 0, separate stdout/stderr, and a verified HMAC signature. No DeepSeek key is required.
Stop the server with Ctrl+C. The generated token and in-memory sessions disappear with the process.
Install from a clone
Use this path when contributing or testing unreleased changes:
startup.sh creates .venv, installs the package, and delegates to the same term-mcp CLI used by packaged installations.
Safety boundary
The default is APPROVAL_MODE=inspect with network disabled.
| Mode | Intended use | Writes | Project code | Approval |
| --- | --- | --- | --- | --- |
| inspect | Repository discovery | Blocked | Blocked | Long-running processes only |
| confirm | Deliberate local work | Policy-scoped | Allowed by policy | Required for risky actions |
| trusted | Pre-approved automation | Policy-scoped | Allowed by policy | Pre-approved, always receipted |
Confirm and trusted modes are not an operating-system sandbox. Test untrusted repositories in a disposable container or VM. Keep WORKSPACE_ROOT narrow, ALLOW_NETWORK=false, and never expose the HTTP service directly to an untrusted network.
Read SECURITY.md and the threat model before enabling a wider command surface.
CLI
Run a complete local quality gate with:
Safe recipe catalog
The repository includes six small workflows for repository inspection, Python and JavaScript test discovery, log inventory, port configuration, and proof of the read-only boundary. Every recipe is schema-versioned, inspect-only, network-free, write-free, bounded, and checked by the production policy before it can run.
Browse the recipe catalog and contribution template. CI executes the complete catalog and runs the no-model benchmark.
See the proof gallery for signed, sharing-redacted success, cancellation, and timeout receipts. The three short demos apply the recipes to an unfamiliar repository, a test surface, and local incident evidence.