thingctx — Claude Code MCP server: what it does, how to install
Turns W3C WoT Thing Descriptions and OpenAPI specs into agent tools. It gates every operation and executes requests without exposing credentials to the model.
claude mcp add --env THINGCTX_POLICY=<THINGCTX_POLICY> --env THINGCTX_APPROVE_WHEN=<THINGCTX_APPROVE_WHEN> --env THINGCTX_FS_ROOT=<THINGCTX_FS_ROOT> --transport stdio thingctx -- uvx thingctxWhat thingctx does
thingctx maps W3C Web of Things JSON descriptions or OpenAPI 3.x specs into agent tools named <thing>__<action>. Calls route directly across target protocols like HTTP, MQTT, or local handlers based on the address scheme in the description. No extra bridge is needed.
Secrets never reach the model prompt. Secrets stay local. The server handles authorization per operation, which lets you permit read actions while rejecting writes on the exact same target. The shipped exec subprocess transport is locked by default and refuses any command until supplied with an explicit allowlist.
The project requires Python 3.10 or later. While local and subprocess execution work immediately, extra features like Redis support and OpenAPI conversion require installing optional package extras.
What it helps with
- expose local processes or hardware devices to agents via W3C WoT manifests
- import OpenAPI 3.x specifications directly into agent-callable toolsets
- prevent LLMs from directly touching API tokens during tool calls
- restrict subprocess commands using strict allowlists on the
exectransport
Example prompts for the agent
- Import
https://api.example.com/openapi.jsoninto a Thing Description file. - Run the
weather__forecasttool with latitude and longitude arguments. - List all available actions from the local device manifest
pump.td.json.
How to install thingctx
Platform CLI
claude mcp add --env THINGCTX_POLICY=<THINGCTX_POLICY> --env THINGCTX_APPROVE_WHEN=<THINGCTX_APPROVE_WHEN> --env THINGCTX_FS_ROOT=<THINGCTX_FS_ROOT> --transport stdio thingctx -- uvx thingctxReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from thingctx <command>
Platform CLI
codex mcp add thingctx --env THINGCTX_POLICY=<THINGCTX_POLICY> --env THINGCTX_APPROVE_WHEN=<THINGCTX_APPROVE_WHEN> --env THINGCTX_FS_ROOT=<THINGCTX_FS_ROOT> -- uvx thingctxReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from thingctx <command>
Config file
{
"mcpServers": {
"thingctx": {
"command": "uvx",
"args": [
"thingctx"
],
"env": {
"THINGCTX_POLICY": "<THINGCTX_POLICY>",
"THINGCTX_APPROVE_WHEN": "<THINGCTX_APPROVE_WHEN>",
"THINGCTX_FS_ROOT": "<THINGCTX_FS_ROOT>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from thingctx <command>
Config file
{
"servers": {
"thingctx": {
"type": "stdio",
"command": "uvx",
"args": [
"thingctx"
],
"env": {
"THINGCTX_POLICY": "<THINGCTX_POLICY>",
"THINGCTX_APPROVE_WHEN": "<THINGCTX_APPROVE_WHEN>",
"THINGCTX_FS_ROOT": "<THINGCTX_FS_ROOT>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from thingctx <command>
Platform CLI
gemini mcp add -e THINGCTX_POLICY=<THINGCTX_POLICY> -e THINGCTX_APPROVE_WHEN=<THINGCTX_APPROVE_WHEN> -e THINGCTX_FS_ROOT=<THINGCTX_FS_ROOT> thingctx uvx thingctxReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from thingctx <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about thingctx
How do I install thingctx in Claude Code?
Run `claude mcp add --env THINGCTX_POLICY=<THINGCTX_POLICY> --env THINGCTX_APPROVE_WHEN=<THINGCTX_APPROVE_WHEN> --env THINGCTX_FS_ROOT=<THINGCTX_FS_ROOT> --transport stdio thingctx -- uvx thingctx`.
How does thingctx protect API keys?
The model only receives function signatures and parameter schemas. Authentication keys live exclusively in the runtime binding that executes the call.
Can thingctx run terminal commands safely?
Yes, through its exec transport. That transport is locked out of the box and refuses execution until an explicit allowlist is configured.
