restic-defensive-mcp

Are my backups present and recent, is their metadata readable, and does a snapshot contain the files I expect?

Restic is a powerful backup tool. An unrestricted caller can:

- delete retention history (forget/prune)
- overwrite or extract data (backup/restore/dump)
- unlock or rewrite repository state
- accept arbitrary repository URLs and password commands

Thin wrappers that expose "run restic with these args" or per-call repository overrides recreate that blast radius inside MCP.

This project is different by construction:
- Repositories aredeclared and sealed at process start
- MCP surface isexclusively read-only(no feature flag for writes)
- Only acompiled-in subsetof restic subcommands can be built
- No shell:exec.CommandContextwith fixed argv only
- Hosts, tags, paths, and result sizes arebounded
- Secrets come frompermission-checked files, neverRESTIC_PASSWORD_COMMAND
- Errors arestructured and redacted
- Every tool reports an explicitcost class(light/moderate/expensive)

- Go 1.25+ (build)
- restic0.17.1+onPATH(orrestic_binaryin config); tested with 0.19.x
- An MCP client that supports local stdio servers

git clone https://github.com/ThomasCrouzet/restic-defensive-mcp.git cd restic-defensive-mcp make build ./bin/restic-defensive-mcp --version

- Create password and repository location files (regular files, no symlinks). Avoid placing the password in shell history:

secret_dir="${XDG_CONFIG_HOME:-$HOME/.config}/restic-defensive-mcp" install -d -m 700 "$secret_dir" install -m 600 /dev/null "$secret_dir/repository" printf '%s\n' '/path/to/your/repo' > "$secret_dir/repository" install -m 600 /dev/null "$secret_dir/password" "${EDITOR:-vi}" "$secret_dir/password"

-

Copy and editconfig.example.yaml, including the two file paths above.

./bin/restic-defensive-mcp --config /path/to/config.yaml

- Point your MCP host at the binary with--config(stdio transport only).

Example MCP host snippet (illustrative):

- MCP callers pass onlyrepository_id
- Preferrepository_file+password_fileover inline secrets
- Repository locations and backend credentials are loaded and sealed at boot; changing their source files does not retarget a running server
- allowed_hosts/allowed_tags/allowed_pathsareenforcement, not cosmetics
- Empty allowlists meanno restrictionfor that dimension; the server logs a boot-time warning (empty_allowlist) so operators notice
- Unknown YAML keys and multiple YAML documents are rejected
- Secret files must be regular, non-symlink files; Unix requires mode0600or stricter, while Windows deployments must enforce equivalent NTFS ACLs
- find_filesrequires an explicitpathwhen multiple roots are allowlisted
- Runtime limits: zeros become defaults; values outside absolute min/max arerejected(not silently clamped). Defaults are the recommended starting point; values may be raised only up to those ceilings

Inspection isnota pure no-op on disk or on the repository lock table:

- restic may create or update alocal cache(cache_diror default)
- restic may take arepository lockduring snapshots/ls/find/stats

This server never intentionally mutates backup contents or snapshot sets. It also never runs full data verification (restic check --read-data).repository_statsanswers size/count questions only.

Snapshot file names, paths, hosts, tags, sizes, and timestamps aresensitive. This server:

- never returns filecontents
- never returns repository URLs or secret file paths
- bounds listings and find results
- sanitizes control characters in names
- keeps audit logs free of full paths by default

Runs the end-to-end harness against a throwaway restic repository created byinternal/testrepo. It exercises every MCP tool, proves path denial and the absence of mutation tools, then removes the fixture. Repository operations stay local; normal Go module downloads may still occur on a fresh checkout.

make fmt make lint make test # unit tests make race # race detector make fuzz-smoke # short run of every fuzz target make integration # real restic temp repo (requires restic) make vet

Restic itself is an external binary, not a Go module.

- Backup orchestration or scheduling
- Restore / forget / prune / unlock / repair
- Generic restic CLI proxy
- Autorestic config import
- Remote multi-tenant API
- Fullrestic check --read-dataas a casual tool
- Telemetry or auto-update

Interact with the Intelligent Content Management platform through Box AI.

An MCP server for interacting with AIStor and MinIO object stores.

Access various storage services like S3, GCS, and Azure Blob through the Apache OpenDAL™ project, configured via environment variables.

Manage AWS S3 buckets and objects, including policies, tagging, and configurations.

Manage AWS S3 operations, providing secure access to S3 buckets through pre-signed URLs.

Upload images and videos to Cloudinary from compatible MCP clients.

DeFi agent definitions JSON API - Production-ready agents for Web3, crypto trading, portfolio management, and blockchain automation

GCP Bucket Connector (data-connectors-ai)

Read-only MCP server for GCP Cloud Storage: list objects in a bucket.

Access and manage your Google Photos library with AI assistants.