infimount

Safe storage access for AI agents.
Browse local folders, object storage, and WebDAV from one native app. Control which storages and paths MCP agents can access — with confirmations, audit, and local-first security.

Local-first by default

Infimount stores storage sources, app config, MCP settings, and credentials on your machine. Default storage registry: ~/.infimount/storages.json. MCP runtime settings: ~/.infimount/mcp_settings.json. No Infimount-hosted backend is required.

Install

Current stable release: v0.8.0

Linux

curl -fsSL https://github.com/infimount/infimount/releases/latest/download/install.sh | sh

The script verifies checksums and chooses .deb, .rpm, or AppImage automatically. Override with INFIMOUNT_INSTALL_FORMAT=deb|rpm|appimage.

Manual downloads:

• DEB for Debian/Ubuntu
• RPM for Fedora/RHEL
• AppImage for portable use

macOS

curl -fsSL https://github.com/infimount/infimount/releases/latest/download/install.sh | sh

Or use Homebrew:

brew tap infimount/infimount
brew install --cask infimount

Manual download: Infimount.dmg

Windows

Run in PowerShell:

irm https://github.com/infimount/infimount/releases/latest/download/install.ps1 | iex

Manual downloads:

• MSI installer
• Setup EXE

Install notes

Install scripts verify selected downloads against SHA256SUMS.txt. Pin this stable release with INFIMOUNT_VERSION=v0.8.0; latest installs the current stable release. On Linux, the installer warns when another infimount earlier in PATH would shadow the executable that was just installed. Every release requires signed updater artifacts. Platform application signing is included when credentials are configured; this project may publish explicitly platform-unsigned stable or prerelease packages, which can trigger operating-system warnings.

What Infimount does

• Browse storage in one place: local files, S3/S3-compatible storage, Backblaze B2, Aliyun OSS, Tencent COS, Huawei OBS, Azure Blob, Google Cloud Storage, Google Drive, Microsoft OneDrive, WebDAV, and SFTP.
• Work like a desktop file manager: grid and list views, rich previews, drag-and-drop upload, bookmarks, recents, keyboard navigation, global search stop, dual-pane transfer workflows, conflict handling, and transfer queue.
• Validate before you trust a backend: reachability checks report grouped capabilities, sanitized fix hints, and MCP readiness notes.
• Control MCP access explicitly: new storages are not exposed to MCP by default. Enable selected storages, tool lists, path policies, read-only mode, confirmations, and local audit logs.
• Prepare bounded agent work: Agent Tasks on main, targeted for v0.8.1, copy only selected files into a local Agent Workspace, hand the task to Codex through the existing MCP boundary, review outputs, and publish explicitly approved unchanged files with create-only writes.
• Stay backend-agnostic: file operations route through Apache OpenDAL so capabilities are detected and documented per backend.

Workbench

Infimount includes daily file-manager workflows beyond basic browsing:

• Dual-pane copy, move, compare, and update flows across supported storages.
• Transfer queue with queued/running/completed/failed states, retry, active or queued cancellation, progress visibility, and persisted transfer history.
• Conflict handling for overwrite, discard, or keep-both transfers.
• Bookmarks, recent folders, drag-and-drop upload, rich preview, and roving keyboard navigation in grid/table views.
• Opt-in global search indexing with a Stop control so stale slow-storage responses do not overwrite newer UI state.

Agent Workspaces

Agent Workspaces define a safer storage-scoped MCP boundary for agents and Agent Tasks:

• Create a plain workspace by choosing a name and storage. Infimount derives /agent-workspaces/<name> inside that storage and shows the storage-relative location instead of asking for a second host path.
• Apply a managed workspace-scoped MCP policy automatically. New workspaces are read-only for agents unless the desktop user explicitly opts into writes.
• Require an explicit absolute Local Filesystem storage root for workspace namespace binding; shell-style $HOME/..., ~/..., missing, or relative roots are rejected before workspace creation.
• Keep older current-schema template memory files and checkpoints available as compatibility behavior for existing workspaces; new workspace creation no longer asks for coding, research, or data-analysis agent types.
• Review workspace activity grouped from local events and MCP audit events that fall under the workspace root.
• Bind each workspace to the storage namespace it references; changing the storage namespace or removing the storage while workspaces are bound is blocked until the workspaces are recreated.

Agent Tasks

Agent Tasks are implemented on main and targeted for v0.8.1. The current v0.8.0 stable release does not include this workflow.

• Prepare only the files selected in the File Browser into a bounded tasks/<uuid>/inputs/ snapshot. Preparation never moves or mutates the source and never grants new MCP access to it.
• Use an explicitly read-write Local Filesystem Agent Workspace for task outputs. Read-write workspace creation is a separate desktop opt-in.
• Launch the prepared task in Codex through the existing Infimount MCP integration rather than giving Codex a second storage-access path.
• Review files under outputs/ with byte size, SHA-256, and bounded previews before deciding what may leave the task workspace.
• Publish nothing by default. The desktop user selects outputs, destination storage, destination folder, and either fail or rename conflict handling, then approves an exact publication preview.
• Publish with OpenDAL create-only writes and re-verify source and committed destination hashes. Agent Task publication has no overwrite mode.
• Write a unique create-only publish-receipt-<publication-id>.json after each fully successful publication. Partial multi-file failures surface cleanup-required state rather than pretending the operation was atomic.

See the Agent Tasks contract for the complete safety model, limits, and known local-filesystem TOCTOU boundary.

First run and upgrades

GitHub shows a copy button on each fenced command block in this README.

Linux AppImage:

chmod +x Infimount-*.AppImage
./Infimount-*.AppImage

Linux DEB:

sudo apt install ./Infimount-amd64.deb

Linux RPM:

sudo rpm -i Infimount-x86_64.rpm

macOS DMG: open the DMG and drag Infimount to Applications. Platform-signed releases are notarized when Apple credentials are configured. For an explicitly platform-unsigned release, expect Gatekeeper warnings and use the documented per-app approval path only after verifying the release checksums and provenance; never disable Gatekeeper globally.

Windows MSI or EXE: run the installer. Authenticode signing is included when Windows credentials are configured. For an explicitly platform-unsigned release, expect SmartScreen warnings and verify checksums, provenance, and the release signing status before proceeding.

Upgrade by running the latest installer again. For Homebrew installs:

brew update
brew upgrade infimount
brew upgrade --cask infimount

Build from source

See Building from Source below.

---

Supported Storage Backends

Backend	Status	Notes
Local Filesystem	✅ Stable	Full read/write support
Amazon S3 / S3-compatible	✅ Stable	Any S3-compatible service; versioning depends on bucket support; optional default object ACL
Backblaze B2	✅ Stable	Native OpenDAL B2 backend with read/write/list/delete, copy, presign, and capability-gated user metadata writes
Aliyun OSS	✅ Stable	Object storage via OpenDAL; read/write/list/delete/copy and presigned links; no generic rename/create-dir capability
Tencent COS	✅ Stable	Object storage via OpenDAL; read/write/list/delete/copy and presigned links; no generic rename/create-dir capability
Huawei OBS	✅ Stable	Object storage via OpenDAL; read/write/list/delete/copy and presigned links; no generic rename/create-dir capability
Azure Blob Storage	✅ Stable	Container/account key auth; advanced capabilities depend on account support
Google Cloud Storage	✅ Stable	Service account JSON; advanced capabilities depend on bucket support
WebDAV	✅ Stable	Nextcloud, ownCloud, etc.; optional compatibility mode for servers that cannot create collection placeholders
SFTP	✅ Stable	Linux/macOS only; key-based SFTP via OpenDAL. Password login is intentionally not exposed because OpenDAL SFTP does not support it
FTP	⏸ Disabled	Temporarily disabled in v0.8 due to an upstream command-injection vulnerability; may return after a fixed OpenDAL release

Use Validate in Add/Edit Storage to check reachability, grouped capability summaries, sanitized fix hints, and MCP readiness notes before browsing or exposing a storage to agents. For MCP/versioning details, see Backend Capability Matrix.

---

🤖 MCP Integration

Infimount includes a Rust MCP server for local AI clients and agent workflows.

• Transports: stdio and Streamable HTTP
• HTTP auth: bearer token required for non-loopback desktop HTTP and for headless HTTP unless explicitly started in loopback-only insecure dev mode
• Scoped access: new storages are not exposed to MCP by default; expose only selected storages, disable individual MCP tools, and restrict storage paths with allow/deny prefixes
• Risk controls: write/delete/presign/version-delete operations can require approval in Infimount before execution
• Audit trail: local bounded MCP audit log records allowed, denied, confirmed, and failed tool activity without storing secrets or presigned URL signatures
• Version-aware tools: supported where the backend and storage configuration support object versions; version listing and write_file are bounded (10,000 scanned/1,000 per page and 4 MiB respectively)

Setup guide: MCP Client Setup

Agent integration guide: Agent Integrations

Security model: Security Model

Operational guides: Agent Workspaces, Agent Tasks, Recovery, Privacy, and Troubleshooting

---

🛠️ Building from Source

Prerequisites

• Rust 1.94+ — rustup.rs (the pinned workspace toolchain and current MSRV)
• Node.js 18+ and pnpm — pnpm.io
• Tauri dependencies — Platform-specific setup

Quick Start

# Clone the repository
git clone https://github.com/infimount/infimount.git
cd infimount

# Install frontend dependencies
cd apps/desktop
pnpm install

# Run in development mode
pnpm tauri dev

Build for Production

cd apps/desktop
pnpm build          # Build React frontend
pnpm tauri build    # Bundle native app

Outputs:

• Linux: target/release/bundle/deb/, bundle/rpm/, bundle/appimage/
• macOS: target/release/bundle/dmg/, bundle/macos/
• Windows: target/release/bundle/msi/, bundle/nsis/

📖 For release operations and checklist, see docs/releasing.md. For Google Drive and Microsoft OneDrive setup, see docs/oauth-drive-setup.md. To verify public download links before announcing a release, run scripts/check-release-links.sh.

---

🎯 Roadmap

Current Focus

• Local, S3/S3-compatible, Backblaze B2, Aliyun OSS, Tencent COS, Huawei OBS, Azure Blob, GCS, Google Drive, Microsoft OneDrive, WebDAV, and SFTP browsing
• Grid and list views with file preview, drag-and-drop upload, bookmarks, recents, and transfer queue
• Dual-pane copy/move and compare/update workflows
• MCP support for local AI assistants with explicit storage exposure, tool controls, path policy, confirmations, sessions, and audit
• Version-aware MCP tools where supported by the backend
• Keyboard navigation in virtualized file grid and table views
• OAuth-backed Google Drive and OneDrive with guided local loopback connect, plus SFTP remote-file browsing through OpenDAL
• Capability-aware storage validation summaries with fix hints and MCP readiness notes
• Agent Tasks implementation on main: bounded preparation, Codex handoff, output review, and create-only approved publication; real pilot evidence is the next product-validation phase before broader promotion
• Additional large-directory polish

Future Plans

• CLI companion (infimount-cli)
• Mobile app (iOS/Android)
• Hosted and managed deployment options

---

🤝 Contributing

We welcome contributions! Please read:

• CONTRIBUTING.md — How to contribute
• CODE_OF_CONDUCT.md — Community standards
• GOVERNANCE.md — Decision-making process
• Agents.md — Guidelines for AI assistants

Development Commands

# Run tests
cd apps/desktop && pnpm test        # Frontend tests
cargo test --workspace               # Rust tests

# Lint & format
pnpm lint                            # ESLint
cargo fmt --check                    # Rust formatting
cargo clippy                         # Rust lints

# Enable local pre-commit checks (yamllint, markdownlint, actionlint)
pnpm setup:hooks

---

💖 Support the Project

If Infimount is useful to you, consider supporting its development:

Your sponsorship helps:

• Maintain and improve the codebase
• Add new storage backends
• Keep Infimount free and open source

---

📝 Installation Notes

macOS

Platform-signed releases are signed and notarized when the corresponding credentials are configured. Platform-unsigned stable or prerelease packages may trigger Gatekeeper or SmartScreen warnings; never treat them as notarized or Authenticode-signed. Updater artifacts remain cryptographically signed; verify checksums, provenance, and the release's explicit signing status before installing.

Windows

MSI and EXE installers are Authenticode-signed only when Windows signing credentials are configured. For platform-unsigned releases, expect SmartScreen warnings and do not treat the installer as Authenticode-authenticated. Updater artifacts remain cryptographically signed.

Linux

AppImage needs executable permission:

chmod +x Infimount-*.AppImage
./Infimount-*.AppImage

---

📄 License

MIT License — Copyright © 2026 Infimount Contributors

---

⭐ Acknowledgements

• Apache OpenDAL — Unified storage access layer
• Tauri — Lightweight native app framework
• React + TypeScript — Modern frontend stack
• File Icons — File Icons by Dan Hendricks

---

Made with ❤️ by the Infimount community

Security boundary: local MCP operations reject symlink and reparse-point components. Built-in MCP HTTP is loopback-only; use a TLS reverse proxy for remote deployments.