Stdio

MCP client over stdio: starts the server as a subprocess and talks JSON-RPC over stdin/stdout (newline-delimited). Uses bubblewrap when available; otherwise requires allow_unsandboxed in mcp.json (Flatpak, Windows).

Overlay writes (known gap)

Sandboxed stdio MCP is spawned inside a bwrap overlay with project write roots (default

allow_writes

→

project

). Unlike the

run_command

tool, this path does not run

overlay.scan.run()

or apply changes to the live project index.

• OLLMbwrap.RunSeccomp only adds syscall evidence strings to tool output
• File creates/edits/deletes inside the overlay are not merged to disk
• On disconnect, overlay upper-layer changes are probably lost

TODO: After disconnect (or per tool call), run overlay scan + OLLMbwrap.FileVerification report-back — same pipeline as

run_command

/

libocbwrap

— so MCP filesystem changes persist and update the project index (RPC-backed once on

ollmfilesd

).