The Termic CLI lets a shell drive the app. The MCP endpoint is the same idea for MCP clients: a scoped control plane a model can call as tools, without being handed a terminal to type into.
It is a loopback HTTP listener speaking the stateless MCP revision (2026-07-28), aimed at outside clients such as Claude Desktop or claude mcp add.
Experimental, Phase A. The endpoint carries one full-scope credential. Per-task scoped tokens, which the stateless revision is what makes possible, are Phase B and are not built. Turn it on deliberately.
Turning it on
Settings → MCP endpoint → Enable MCP endpoint.
The endpoint is bound only while it is enabled. There is no auto-launch path and no dormant listener: off means not bound, and the settings page says so rather than implying something is running.
Settings also has one-click setup for the clients people actually use:
- Add to Claude Code, which gives you the
claudecommand to run. - Add to Codex, which gives you the
codexconfig block.
The bound port is preferred across enable and disable cycles and across restarts, so a config you pasted into a client keeps working instead of going stale the next time you launch.
The tools
MCP dispatch goes through the same code path as the CLI, so the endpoint is a presentation of Termic’s verbs rather than a second implementation of them. What the CLI can do, these tools do, identically.
| Tool | What it does |
|---|---|
task_list | List tasks |
task_status | The state of one task, including its tab strip |
task_new | Create a task, optionally with a first prompt |
task_send | Send a prompt to a task’s agent |
task_wait | Block until an agent goes quiet |
task_result | Read what the agent produced |
task_log | Read a tab’s output |
task_diff | The task’s diff |
task_apply | Land the task’s changes |
task_open | Bring a task forward in the window |
task_rename | Retitle a task |
task_archive | Archive a task |
task_tab / task_tab_close | Open and close tabs in a task |
task_agents | The configured agent registry |
Together that is enough for a client to fan work out to several tasks, wait on them, read back what they produced, and clean up, which is the whole point of exposing it.
The threat model
Loopback TCP is reachable by every process on your machine, so the token is the entire boundary. Phase A compensates from day one rather than deferring it:
- Its own credential. The endpoint uses an
mcp-tokenfile (0600, 244 bits), never the CLI’s token. It is never placed in the app’s process environment and never in any terminal overlay, so an agent Termic spawns does not silently inherit it. - Constant-time token comparison, with backoff on repeated auth failures.
- Browser requests are refused. Any request carrying an
Originheader is rejected outright. AHostoutside the loopback names is rejected too, which is the DNS-rebinding case, since that arrives same-origin and therefore carries noOrigin. No CORS header is ever emitted, and preflight is never answered usefully. - No peer identification is attempted. Logs are telemetry, not an authorisation input.
- The port is not a secret; the token is.
Related
- Termic CLI: the same verbs from a shell, and the token model it uses.
- Agents & the registry: what
task_agentsreports. - Sandbox overview: what an agent driving Termic can reach.
- Settings reference: where the MCP page sits.