Rust powered precision file operations for agents.
Chisel
🪛 Rust powered precision file operations for agents. Unix-native tools, minimal context footprint, strict path confinement: use directly with Chisel MCP or bring your own MCP, embeddable in any MCP server in Rust, Python, Nodejs.
https://github.com/user-attachments/assets/af84f1af-db47-4e42-808b-00861504cd34
Install — download a pre-built `.mcpb` bundle (one-click, no build step) or a raw binary from the Releases page — see Standalone usage below.
Agent skill included — `skills/chisel/SKILL.md` teaches agents how to use Chisel at maximum efficiency. Install with:
npx skills add ckanthony/Chisel
Security hardened — Verified properties across two layers: the MCP server (
chisel) and the portable core library (chisel-core). See the Security model section for the full breakdown.
Contents
- Motivation
- Tools
- Standalone usage
- Behind a reverse proxy
- Bring your own MCP
- Extending chisel
- Workspace layout
- Security model
- Platform support
- Development
- Contributing
- Future considerations
Motivation
Most MCP file tools hand an LLM a blank canvas: read anything, write anything, make any mistake. Chisel takes the opposite approach:
- Reduce context overhead — every tool call is compact. File edits go through
patch_apply: the model sends only a unified diff instead of rewriting an entire file, so large-file edits cost a fraction of the tokens - Familiar command patterns —
shell_execexposes the same Unix tools (grep,sed,awk,find,cat, …) LLMs already know well from training data, so prompts stay short and outputs are predictable - Precision over flexibility — a fixed whitelist and strict path confinement mean the model cannot accidentally escape scope or run arbitrary commands
- Safety first — bearer-token auth,
127.0.0.1-only binding, symlink-aware root confinement, atomic writes, and a read-only mode are all on by default - Reusable core —
chisel-coreis a plain synchronous Rust library; any MCP server (Rust, Node.js via WASM, Python via WASM) can embed it without running a second process
Real-world demo
Six tasks on the same markdown file. Left: typical MCP file server. Right: chisel.
File: docs/api.md — 300 lines, 6 headers, one section of ~20 lines.
Task 1 — find all headers
# Typical # Chisel
tool: read_file tool: shell_exec
path: /data/docs/api.md command: grep
args: ["-n", "^#", "/data/docs/api.md"]
← 300 lines returned (~3 000 tokens) ← 6 lines returned (~30 tokens)
model must scan the whole file 1:# API Reference
45:## Authentication
89:## Endpoints
134:## Request Format
178:## Response Format
234:## Errors
Task 2 — read the content under ## Endpoints
# Typical # Chisel
tool: read_file (again, or re-use above) tool: shell_exec
path: /data/docs/api.md command: sed
args: ["-n", "/^## Endpoints/,/^## /p",
← 300 lines returned again (~3 000 tokens) "/data/docs/api.md"]
model must locate the section in context
← 44 lines returned (~440 tokens)
only the Endpoints section
Task 3 — edit one line in that section
# Typical # Chisel
tool: write_file tool: patch_apply
path: /data/docs/api.md path: /data/docs/api.md
content: <entire 300-line file patch: |
with one line changed> --- a/docs/api.md
Tools (2)
shell_execExecutes Unix-native tools like grep, sed, awk, find, and cat to read files with minimal context.patch_applyApplies unified diffs to files to minimize token usage compared to full file rewrites.Configuration
{"mcpServers": {"chisel": {"command": "chisel", "args": ["--root", "/path/to/your/project"]}}}