---

name: ghostlink description: > Drive GhostLink, a sandboxed MCP repo server -- six policy-gated tools (search, read, patch, run, git status/diff) confined to one repo root with output caps, timeouts, and an audit log. USE WHEN: user says "sandbox my agent's repo access", "confine the agent to this repo", "audit what the agent did to my code", "set up GhostLink", or an agent needs code access without filesystem-wide reach. DON'T USE WHEN: user wants to gate spending or tool-call approvals (use spend-guard), wants to build a new MCP server from scratch (use switchblade), or wants repo quality grading (use gauntlet for gates). OUTPUTS: a working GhostLink install wired into the agent's MCP config, the search-read-patch-verify workflow, and audit-trail interrogation.

GhostLink -- Sandboxed Repo Access for Coding Agents

Version: 1.0.0 Price: $19 Type: Skill

Description

The default coding-agent setup hands the model your entire filesystem and hopes for the best. Every path traversal bug, every over-eager rm, every "helpful" edit outside the project -- all of it runs with your user's full permissions, and none of it leaves a trail.

GhostLink is the wall between an agent and everything that isn't the repo. It is a local-first MCP server exposing exactly six tools -- repo.search, repo.read_file, repo.apply_patch, repo.run, git.status, git.diff -- every one of them confined to a single declared repo root. Output is capped, commands are allowlisted, runs are time-limited, patches roll back atomically on failure, and every call lands in an audit log you can read after the fact. Each response carries a uniform envelope with provenance, so you always know what the agent saw and did.

The server is published open source (@bgorzelic/ghostlink on npm, ISC, 108 tests). What this skill sells is the operating knowledge: correct install and wiring into your MCP config, the search-to-verify loop that keeps agents efficient inside the sandbox, and the audit workflow that tells you what actually happened.

Prerequisites

• Node.js 18+
• An MCP-capable agent client (Claude Code, Claude Desktop, or any MCP client)
• A git repository you want the agent confined to

Setup

1. Install the server:

npm install -g @bgorzelic/ghostlink

2. Register it in your MCP config, pointed at the one repo the agent may touch:

{
  "mcpServers": {
    "ghostlink": {
      "command": "npx",
      "args": ["-y", "@bgorzelic/ghostlink"],
      "env": {
        "GHOSTLINK_REPO_ROOT": "/absolute/path/to/your/repo",
        "GHOSTLINK_LOG": "on"
      }
    }
  }
}

3. Restart the client and confirm the six repo.* / git.* tools appear.

Commands

• "Confine yourself to this repo through GhostLink"
• "Search the repo for [pattern], then read only the files that matched"
• "Apply this change as a patch and show me the diff"
• "Run the tests through the sandbox"
• "What did you touch this session? Show the audit trail"

The Six Tools

| Tool | Does | Bounded by | |------|------|-----------| | repo.search | Content search across the repo | Repo root, result caps | | repo.read_file | Read one file | Repo root, output cap | | repo.apply_patch | Apply a unified diff | Repo root, atomic rollback on failure | | repo.run | Execute a command | Allowlist, timeout, output cap | | git.status | Working-tree state | Repo root | | git.diff | Change inspection | Repo root |

Workflow

1. Wire narrow. One GhostLink instance per repo. Never point GHOSTLINK_REPO_ROOT at a parent directory "to be flexible" -- flexibility is the vulnerability.
2. Search before read. repo.search first, then repo.read_file on hits only. Reading files wholesale burns context and widens what the agent handles.
3. Patch, don't rewrite. repo.apply_patch with a unified diff. A failed hunk rolls back atomically -- there is no half-applied state to debug.
4. Verify through the same wall. Run tests via repo.run; the allowlist and timeout apply to verification too.
5. Read the trail. The audit log records every call with provenance. After any session you don't fully trust, read it before you trust the result.

Output Format

Every tool returns a uniform envelope:

{ ok, tool, data, provenance: { repoRoot, timestamp, truncated } }

truncated: true means the cap fired -- the agent saw a bounded slice, not the whole output. That is a feature; treat un-capped output as the smell.

Guardrails

• Never widen the repo root to make a failing call succeed. If the agent needs a file outside the root, that is a human decision, made by moving the file or the root deliberately.
• Never add a command to the allowlist mid-session because the agent asked. Allowlist changes are config changes, reviewed like config changes.
• The audit log is append-only evidence. Do not rotate or prune it during a session you intend to review.
• A sandbox the agent can reconfigure is not a sandbox. Keep the MCP config outside GHOSTLINK_REPO_ROOT.

Why $19?

You are not buying the code -- it is free on npm and stays that way. You are buying the wiring that makes it safe by default, the workflow that keeps agents effective inside the wall, and the audit discipline that makes "what did the agent do" a question with an answer.

Support

Questions or issues: bgorzelic@gmail.com Source: https://github.com/bgorzelic/ghostlink

---

Published by SpookyJuice -- shopclawmart.com