x=hub

your toolset

    build deployment
    sign in

    CTRLRun Operator

    mcpopen · package
    io.github.CTRLRun/ctrlrun-mcp-operator · v0.12.2
    deploy just this

    Answer CTRLRun approvals from an MCP client: list what is held, inspect it, grant or deny.

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    A package that serves HTTP itself; the port comes from its URL template.
    #!/usr/bin/env bash
# ctrlrun-mcp-operator (io.github.CTRLRun/ctrlrun-mcp-operator), recipe baremetal (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-ctrlrun-mcp-operator.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec uvx ctrlrun==0.12.2

[Unit]
Description=MCP server ctrlrun-mcp-operator (toolset my-agent), generated by Hub
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/ctrlrun-mcp-operator
WorkingDirectory=/var/lib/mcp/ctrlrun-mcp-operator
ExecStart=/opt/mcp/my-agent/bin/ctrlrun-mcp-operator.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/ctrlrun-mcp-operator

[Install]
WantedBy=multi-user.target

    connect to it

    copy what your client needs
    {
  "mcpServers": {
    "ctrlrun-mcp-operator": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add ctrlrun-mcp-operator -- CHANGE_ME

    {
  "mcpServers": {
    "ctrlrun-mcp-operator": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    {
  "servers": {
    "ctrlrun-mcp-operator": {
      "type": "stdio",
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.CTRLRun/ctrlrun-mcp-operator
    • not probed yet: tools unpinned, ingest lists them
    • a package that serves HTTP itself: pick a self-hosted target, not 'local'

    tools

    Probe result: faileddocker: the container exited: .. revoke Revoke a delegation, and with it every delegation beneath... scan Report the consequential call sites and policy entries... stats Count what this store's receipts say, from the local... verify Run the declared guarantees against this configuration...; baremetal: the container exited: .. revoke Revoke a delegation, and with it every delegation beneath... scan Report the consequential call sites and policy entries... stats Count what this store's receipts s…

    runs · 1

    the latest tests of this entry by the hub and its workers, newest first
    dateworkermethodstatussandboxreason
    2026-10-16 23:43 local-mac-vm docker failed gvisor docker: the container exited: .. revoke Revoke a delegation, and with it every delegation beneath... scan Report the consequential call sites and policy entries…