mcpu

Give an agent a git remote. Do not give it a shell.

This Worker lists files, shows one file, accepts MCP tool calls, holds a draft in memory, can commit that draft, and can deploy worker.js only when an imprint release is verified.

Version stays 0.0.1.

What you can do now

Open the Worker origin.

• GET / — HTML. File names on the left. One file on the right. No terminal.
• GET /ls — { "files": [...] }.
• GET /read?path=README.md — { "path", "contents" }.
• POST /mcp — initialize, tools/list, tools/call.

Tools: repo.status, repo.ls, repo.read, repo.write, repo.diff, repo.commit, repo.deploy, repo.history, grant.create.

With no remote, the tree is AGENTS.md, README.md, worker.js.

repo.write dirties a process draft. repo.commit builds a git commit on an in-memory workspace. A file:// remote does not push. repo.deploy refuses unless .imprint/releases/<sha>.json has proof.verified: true. Without Cloudflare upload secrets it returns uploaded: false.

grant.create stores verbs and paths. A later call that sends grant may write docs/** and gets 403 on README.md. A call with no grant is not checked.

What this is not

• There is no Access check in this Worker.
• There is no doctor, no /health, no mcpu-bridge in this repo.
• There is no open/close session and no Durable Object draft.
• The agent can still push if you point it at an https remote. Default branch is not protected here.
• Write and deploy are not separate secrets.
• The face does not write, commit, or send a grant.
• src/mcp.ts (stdio) is local only. It is not in git.

Run

bun test
bun scripts/face-proof.mjs
npx tsc --noEmit

face-proof.mjs plants GIT_TOKEN=leak-me and fails if that string appears in /, /ls, or /read.

Bindings

wrangler.jsonc binds Durable Object class GrantDO as GRANT (sqlite migration v1-grant). Tests inject a store. They do not call env.GRANT.

Set GIT_REMOTE / GIT_TOKEN (or the older ARTIFACTS_* names) when you want a real remote. Set IMPRINT_DIR before repo.deploy.