Self-hosted MCP server for HermitHost — fs, http, and shell tools with SSRF protection and API-key auth