self-hosted mcp server · v0.4.8
66 tools. One server. Two transports.
Point any MCP client at one process you host yourself.
raven-mcp speaks stdio for local clients and JSON-RPC over HTTP
for remote ones, with workspace confinement and keyed auth on both.
MCP 2025-03-26 Python 3.11+ MIT License no telemetry
Replayed from a live raven-mcp process by
scripts/record_site_frames.py — no frame here is typed by hand.
git clone https://github.com/ssrjkk/raven
cd raven
pip install .{
"mcpServers": {
"raven": {
"command": "raven-mcp",
"args": ["--workspace", "/path/to/project"]
}
}
}
Python 3.11+ · installs raven-mcp and ravencode-mcp ·
the full install guide
Counted from the tree
Five numbers the test suite recomputes on every commit. They are written into
site/stats.js by the recorder rather than typed into the page, so
a count that drifts from the code fails CI instead of shipping a wrong claim.
tools/list returnschannel.py eachpyproject.tomlThe registry by category
Why Raven
Your code, your keys, your infrastructure. No Raven-run service in the middle, no telemetry by default, no vendor lock-in.
One Python process on your own server. Nothing of yours runs on anyone else's hardware: the calls it makes go to the LLM provider, the messengers and the tools you configure, and every one of those destinations is listed in the egress map.
nothing between you and the model
Files, shell, git, web search, code analysis, testing, memory, routines, monitors — all over MCP.
one registry, every surface
stdio for local clients that spawn the server as a subprocess, JSON-RPC over HTTP for remote access.
identical frames on both
Every file operation is bounded to your project. Symlinks resolved, escape attempts blocked.
refused, never silently rewritten
HTTP transport requires a secret token. Fail-closed: unconfigured means rejected, not accepted.
Bearer or X-Raven-Key
Use it, modify it, distribute it. No copyleft, no strings attached. The server is Python you can read end to end, and every page here is built from the same tree the package ships — the tool list, the recorded frames and the five counts above all come out of the repository they describe.
source, tests and documentation in one repository
Request path
What happens between a client pressing Enter and the tool's own text landing back in the reply — four stages, each quoted from the code that runs it.
A single JSON object, newline-terminated. Nothing about it is specific
to Raven: this is the tools/call shape the MCP
specification defines, which is why any client can send it.
{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"read","arguments":{"path":"README.md","max_chars":100}}}On stdio the frame goes down the pipe the client opened. On HTTP the
same bytes become the body of POST /mcp/rpc, and the call
is refused before anything is parsed unless an
Authorization: Bearer or X-Raven-Key header
checks out.
POST /mcp/rpc HTTP/1.1
Authorization: Bearer <token>
Content-Type: application/jsonBefore execution the name and its arguments pass through the ruleset the agent path obeys as well. A denied call comes back as an error, not as an empty result that reads like success.
{"jsonrpc":"2.0","error":{"code":-32601,"message":"Unauthorized"}}'process.run' is denied by policy - 'process.run' is in TOOLS_DENYThe reply is the server's own answer to the frame in stage 01, recorded
from the process instead of written for the page — including the
truncation marker the read tool emits when a file is
longer than the budget it was given.
{"jsonrpc":"2.0","id":4,"result":{"content":[{"type":"text","text":"<div align=\"center\"> … (truncated, 8720 total chars)"}]}}Run it
The same tools are reachable as an MCP server, as a terminal coding agent with its own session store, and behind a gateway that holds the channel adapters.
Stdio for a client that spawns the process, JSON-RPC over HTTP for one that reaches it across a network.
raven-mcp --workspace <dir>
ravencode-mcp --workspace <dir>RavenCode runs the registry in an agent loop, keeps sessions on disk, exports them with credentials stripped and answers as an OpenAI-compatible endpoint.
ravencode tui <dir>
ravencode serve --port 8080
ravencode session export <id>One process holds the registry, the DM policy and the messengers, so a chat message reaches the same tools a client frame does.
raven start
raven start --daemon
ravenflowMap
Each part of the product has its own page: the registry, the gateway, the request path, the refusals and the install steps.