GhostApi MCP Server | MCP Server List

A local API sandbox, dashboard, and MCP control plane for building third-party integrations without touching production.

Quickstart·MCP Setup·How It Works·SDK Recipes·Contributing

npx @yiaany/ghostapi init npx @yiaany/ghostapi run -- npm test

AI coding agents are now strong enough to write Stripe checkouts, OpenAI workflows, GitHub automations, Twilio messaging, and email integrations. The dangerous part is that they also run the code they write.

GhostAPI gives agents a local universe where integrations behave like real providers, but every request stays on your machine.

On supported Linux hosts,ghostapi run -- <command>adds a loopback-only namespace boundary for a target process and its ordinary descendants. It fails closed when that boundary cannot be created; it is not a proxy fallback or a hostile-code filesystem sandbox. See the egress threat model.

Use ghostapi.policy.yamlto keep network, credential and required-scenario decisions versioned, deterministic and reviewable.

Generate CI-ready evidence withghostapi evidence generate --policy ghostapi.policy.yaml --ci; the JSON artifact is redacted, canonicalized and rejected if later corrupted.

Use the GitHub Actions PR safety checkto make an enforced run plus sanitized evidence a required status check, or follow the generic CI guideon another CI platform.

Turn explicitly allowed sandbox JSON/HAR traffic into a portable deterministic bundle withghostapi record --input capture.har --allow-sandbox-host api.sandbox.example --approve, then run it offline withghostapi replay bundle.json --requests requests.json. The recorder removes secrets, redacts default PII categories, variables unstable IDs/timestamps, omits binary/multipart bodies, blocks external redirects, and requires approval when its sanitization summary found potentially sensitive traffic. It never records production hosts by default or persists raw temporary payloads. See the record and replay guide.

Import a bounded OpenAPI 3.0 JSON subset or a sanitized HAR into deterministic contracts usingghostapi contract import-openapiandghostapi contract import-har, then runghostapi contract diff --baseline base.contract.json --candidate head.contract.json --policy ghostapi.policy.yaml --ci. The importer never resolves$refor remote URLs; unsupported features fail closed. Contract diffs classify endpoint, request/response schema, enum/status, and provider-pack capability drift as breaking, non-breaking, or uncertain, and can be included inghostapi evidence generatefor CI policy enforcement. See the contract guide.

Score agent behavior with deterministic evals usingghostapi eval --template retry-after --evidence .ghostapi/reports/latest.json --cior a local JSON spec. Core security scoring depends only on sanitized evidence, not an LLM judge, and forbidden actions such as production egress or secret leakage override cosmetic success. See the agent eval guide.

Create a deterministic, local shared state withghostapi world create --id subscription-recovery --seed demo-seed. A world uses one canonical synthetic identity across Stripe, GitHub, email, and generic REST projections; it supports atomic local transitions, reset, and snapshot forks without cloud tenancy or real PII. See the synthetic world guideand end-to-end example.

The localghostapi actiongateway uses a versioned action envelope, canonical hash, structured approval, policy/evidence references, identity recheck, idempotency, and receipt chain to execute one synthetic-world operation. It has no real-provider executor, credentials, or outbound side effect. See the synthetic action gateway guideand threat model.

The public credential-broker library keeps provider secret material behind an injected vault boundary and executes through a server-side executor rather than returning a secret or grant to an agent. The shipped implementation has no CLI, MCP, provider, HTTP, environment-secret, or production side-effect path; its in-memory vault/provider adapters are tests only. See the credential broker guideand threat model.

The local approval inbox derives risk from exact synthetic action envelopes, applies bounded human approval policies, and emits single-use action-hash-bound artifacts with an audit chain. It has no hosted UI, notification integration, bearer approval link, or production execution path. See the approval inbox guideand threat model.

The local synthetic trust ladder prepares evidence-basedsimulatethroughbounded-autopromotion contracts, deterministic canary assignment, shadow/outcome hash comparisons, auto-demotion/circuit-breaker policy, and rollback audit reasons. It does not execute actions or authorize production; localdry-runandtrustedremain explicitly unsupported. See the trust ladder guideand threat model.

The local safety controller persists scoped kill switches, budget reservations, circuit breakers, bounded queue/dead-letter state, emergency audit records, and a synthetic game-day drill. It controls only the existing local synthetic action mutation and has no provider stop, external execution, or hosted emergency endpoint. See the kill-switch threat modeland runbook.

The local action ledger turns an existing synthetic action record into a tenant-scoped, SHA-256 chained timeline of intent, approval, execution, provider-receipt, verification, and compensation evidence. It exports only the authorized tenant's redacted structured entries and can create a deterministic, no-network incident regression fixture that preserves ambiguous outcomes asrequires_reconciliation. It is local tamper evidence, not an immutable external audit/compliance system. See the[ledger and incident-replay threat model.

…