Settings

MCP Console runs real commands as its own service account, with that account's files, network access, programs and inherited environment. Configure it for a group of people who are trusted with that environment: use a separate approved command environment for unrelated groups.

In the MAIT image, Console is available through MCP Registry as console, with browser access enabled. A standalone installation can differ. Ask its owner which connection and browser route are provided before changing settings.

--session-mode per-connection is the default and gives each connection its own terminal namespace. --session-mode shared puts every connection in one namespace, so everyone connected can operate on one another's terminals; use it only where all participants trust each other's work. Reconnecting does not restore an earlier session.

For standard input and output, capture standard error separately, because standard output carries the protocol. Leave MAIT_LOG_FORMAT=json unset there: that log format writes to standard output and breaks the stream.

Keep the service account's runtime directory private and ask its owner to resolve startup failures. Accept a new service with the first command and named-shell exercise in Get started. If reload continuity or browser access is required, verify each separately; a first command does not establish either.

The cleanup check runs every five minutes, so these are not exact deadlines. Plan capacity with the service owner and inspect actual terminals after concurrent creation requests. A malformed number falls back to the default and zero is not a general way to switch a limit off. Do not use these settings as resource isolation or billing limits.

A single watch can set its own interval and sustained time. Asking more often than the snapshot cadence returns the same measurement.

The bridge works beside any MCP transport, standard input and output included, so turning it on adds a network listener even when MCP has none. For a browser on the same machine:

MCP_CONSOLE_WEB=1 MCP_CONSOLE_WEB_ADDR=127.0.0.1:7680 mcp-console serve --transport unix --socket /absolute/private/dir/console.sock

Reach it only through an HTTPS route you operate, and only from trusted clients. Because one address is used to listen and to advertise, an address the service cannot bind locally, such as a host port mapped into a container, cannot be set directly. For access through a reverse proxy or tunnel, keep the local address and forward the scheme, host, port, path, query string and WebSocket at the proxy; a page served over HTTPS uses a secure WebSocket. The returned attachUrl is built from configuration and does not prove the listener started: if binding fails, the service logs it and MCP keeps working.

Each terminal must still be opted in one by one with web: true. What the person with the link can do, and how to take it back, is in Let a person watch or type:

• A link is a credential: anyone who holds it can read the terminal, type into it and resize it. Send it only through a private channel agreed in advance, and never put it in a public issue, screenshot or diagnostic.
• Confirm the HTTPS route with the service owner before confidential input is typed.
• Repeating web: true replaces the private link. Disable the link with web: false. To end browser access at once, close the terminal with terminal_close.
• Disable the link with web: false before you detach a terminal. Plan for the idle-cleanup rules even while someone is typing in the browser.
• Obtain a new private link after a reload.

Closing a Unix or HTTP connection alone does not establish session cleanup and can leave terminal records and work present until explicit close, expiry or service shutdown. Closing standard input for a client-owned stdio server stops that service; it is the ordinary-stop case above. Close or detach owned terminals deliberately before disconnecting.

After a reload, persistent terminals can return detached with reconstructed basic details. Execution history, read positions, run captures, watches, browser links and original timestamps are not restored. Read the current output and establish the workload's actual state before continuing. A tracked command can defer idle cleanup for up to 24 hours; browser activity and statistics or frame polling do not keep a terminal active by themselves.

For work that must survive machine loss, the workload needs its own checkpoints and saved results. The steps for an actual handoff are in Hand a terminal to the next connection.

Limits refill over time and allow an initial burst. A call that is too frequent returns an error with a retry interval. Client and transport deadlines can end a wait separately.

Commands can write files and use the environment's network. Keep required reports and checkpoints in the workload's durable output; do not treat terminal history as its only copy.

• Treat access to any console endpoint, socket or attachUrl as permission to run commands as the service account.
• Keep each socket in a directory only your account can enter, and keep HTTP on loopback, or put an authenticated, encrypted proxy that you operate in front of it.
• Avoid inheriting credentials that the intended commands do not need.
• Remove browser links, environment values, command arguments and unrelated terminal text from any diagnostic you share.

• Tools
• Problems and fixes
• Use cases