Secure execution layer for AI assistants
Jervis Desktop MCP
Lets AI assistants work inside a developer's real projects — files, git, processes, browser — over the Model Context Protocol, with read-only defaults, per-workspace permissions and an audit trail.
Context
Chat-based assistants are good at reasoning about code but can't see the project on a developer's machine. Giving them raw shell access solves that and creates a much bigger problem.
Constraints
Access has to be explicit per project, safe by default, work for both local IDE agents and a remote assistant, and leave a record of what was done.
Architecture
A single tool registry exports JSON-Schema contracts for filesystem, search, git, process/PTY, browser, sandbox and workflow tools. The same registry is served over stdio for IDE agents and over stateless Streamable HTTP for remote clients.
An Electron companion app (English and Arabic) is where the developer pairs devices, adds projects and chooses read-only or editable access for each one.
- AI clients
- ChatGPTremote
- Claude Code · Codex · Cursor · VS Codestdio
- Transport & identity
- Streamable HTTP
- OIDC / JWTRFC 9728
- Device leases
- Policy
- Read-only default
- Workspace roots
- Audit chain
- Tool registry
- Fileshash-guarded edits
- Gitcheckpoints
- ProcessesPTY
- Browser
Decisions
Read-only is the default profile; writes require an explicit workspace grant and are confined to registered roots.
File edits are hash-guarded, so an assistant can't overwrite a file that changed since it last read it; git checkpoints make every change reversible.
Every action is appended to a tamper-evident audit chain.
Outcome
Release candidate with a bilingual landing page and desktop companion, CI for the runtime and desktop packages, and stdio support for Claude Code, Codex, Cursor and VS Code.
Screens
