The Termic CLI lets a shell drive the app. The MCP endpoint is the same idea for MCP clients: a scoped control plane a model can call as tools, without being handed a terminal to type into.
It is a loopback HTTP listener speaking the stateless MCP revision (2026-07-28), aimed at outside clients such as Claude Desktop or claude mcp add.
Experimental, Phase A. The endpoint carries one full-scope credential. Per-task scoped tokens, which the stateless revision makes possible, are Phase B and are not built. Only turn it on if you need it.
Turning it on
Settings → MCP endpoint → Enable MCP endpoint.
The endpoint is bound only while it is enabled. Nothing starts it automatically, and the settings page shows when it is off.
Settings also has one-click setup for two clients:
- Add to Claude Code, which gives you the
claudecommand to run. - Add to Codex, which gives you the
codexconfig block.
The bound port is preferred across enable and disable cycles and across restarts, so a config you pasted into a client keeps working after you relaunch.
The tools
MCP dispatch goes through the same code path as the CLI, so each tool behaves exactly like the matching CLI verb.
| Tool | What it does |
|---|---|
task_list | List tasks |
task_status | The state of one task, including its tab strip |
task_new | Create a task, optionally with a first prompt |
task_send | Send a prompt to a task’s agent |
task_wait | Block until an agent goes quiet |
task_result | Read what the agent produced |
task_log | Read a tab’s output |
task_diff | The task’s diff |
task_apply | Land the task’s changes |
task_open | Bring a task forward in the window |
task_rename | Retitle a task |
task_archive | Archive a task |
task_tab / task_tab_close | Open and close tabs in a task |
task_agents | The configured agent registry |
Together that is enough for a client to fan work out to several tasks, wait on them, read back what they produced, and clean up.
The threat model
Loopback TCP is reachable by every process on your machine, so the token is the only thing keeping other processes out. Phase A ships these protections:
- Its own credential. The endpoint uses an
mcp-tokenfile (0600, 244 bits), never the CLI’s token. It is never placed in the app’s process environment and never in any terminal overlay, so an agent Termic spawns does not silently inherit it. - Constant-time token comparison, with backoff on repeated auth failures.
- Browser requests are refused. Any request carrying an
Originheader is rejected outright. AHostoutside the loopback names is rejected too, which is the DNS-rebinding case, since that arrives same-origin and therefore carries noOrigin. No CORS header is ever emitted, and preflight is never answered usefully. - No peer identification is attempted. Logs are telemetry, not an authorisation input.
- The port is not a secret; the token is.
Related
- Termic CLI: the same verbs from a shell, and the token model it uses.
- Agents & the registry: what
task_agentsreports. - Sandbox overview: what an agent driving Termic can reach.
- Settings reference: where the MCP page sits.