Operate the boundary, not a black box.

First signed result.

Requirements: macOS or Linux, Python 3.10–3.13, and pipx. A DeepSeek API key is not required for local discovery, planning, execution, receipts, or the guided demos.

pipx install "git+https://github.com/OthmaneBlial/term_mcp_deepseek.git@v1.0.0"
cd /path/to/the/repository/you/want/to/inspect
term-mcp serve

The server prints a one-time bearer token. Open http://127.0.0.1:8000, paste the token, select Inspect workspace, then build and execute the visible pwd plan. The expected result is a signed succeeded receipt with exit code 0.

From a clone

git clone https://github.com/OthmaneBlial/term_mcp_deepseek.git
cd term_mcp_deepseek
./startup.sh token
./startup.sh

One path. No shortcut.

DeepSeek may suggest text, but model output is never an execution trigger. Human and MCP clients use the same deterministic server, policy engine, execution service, and receipt signer.

1. Intent. A human or MCP client asks for a concrete local result.
2. Plan. The server creates a versioned, session-bound execution plan.
3. Policy. Argv, workspace, paths, network, mode, risk, and limits are resolved.
4. Approval. A plan-specific state transition is required when policy says so.
5. Process. Execution uses an argv list, no shell, reduced environment, process group, timeout, and output bounds.
6. Receipt. Every final state is structured, redacted, and HMAC-signed.

Start narrow.

The default is inspect with network denied. A wider mode is a deliberate operator decision, not something a prompt or model can select.

STDIO first. HTTP when needed.

The server targets modern MCP 2026-07-28 and supports the legacy 2025-11-25 initialize lifecycle. Both transports share one dispatcher and tool catalog.

Recommended local STDIO configuration

{
  "mcpServers": {
    "term-mcp-deepseek": {
      "command": "/absolute/path/to/term-mcp",
      "args": ["stdio"],
      "env": {
        "WORKSPACE_ROOT": "/absolute/path/to/your/project",
        "APPROVAL_MODE": "inspect"
      }
    }
  }
}

“Not tested” is preserved as evidence, not converted into a compatibility claim. STDOUT contains protocol JSON only; diagnostics go to STDERR.

Readable locally. Safe to redact.

Schema 1.0 records command digest, mode, risk, approval, policy, status, timestamps, duration, exit code, signal, bounded stdout/stderr, truncation, and signature.

• succeeded — the bounded process reached exit code 0.
• failed — the process completed unsuccessfully without being conflated with cancellation.
• cancelled — an operator stopped the process and the termination signal is retained.
• timed_out — the approved hard duration was crossed.

A share-safe export replaces command, workspace, arguments, stdout, and stderr with redaction markers, adds sharing_redacted: true, then signs the transformed receipt again.

Portable inspection workflows.

Public recipes declare intent, prerequisites, permissions, steps, expected output, anonymized receipt preview, and risk. Semantic validation requires inspect mode, no network, no writes, low risk, and production-policy acceptance.

term-mcp recipe validate examples/recipes/*.json --workspace .
term-mcp recipe run examples/recipes/inspect-repository.json --workspace .

Fail closed by configuration.

The no-key defaults are sufficient for local inspection. Use term-mcp doctor --json to verify Python, shell, typed configuration, workspace permissions, and STDIO readiness.

cp .env.example .env
term-mcp token
term-mcp doctor --json
term-mcp demo

• AUTH_TOKEN — generated ephemerally when absent; configured values shorter than 32 characters are refused.
• WORKSPACE_ROOT — keep it scoped to the smallest directory needed.
• ALLOW_NETWORK — false by default; widen only for a specific reviewed workflow.
• ALLOWED_ORIGINS — exact origins only; wildcard configuration is refused.
• DEEPSEEK_API_KEY — optional and used only by the isolated advisory panel.

Bounds are part of the plan.

Know what is—and is not—guaranteed.

Inspect mode parses commands without a shell, blocks interpreters and network clients, validates paths against the workspace, rejects symlink escapes, and emits signed, redacted receipts.