toolwrap

ENRU

Download

toolwrap MCP gateway for Claude Code, Codex and Cursor

Give your agent Jira, GitHub and the database. Keep the keys — and the final say.

toolwrap is a desktop app between your AI agent and your MCP servers. Each project gets its own set of tools and credentials, secrets live in your OS keychain, and anything destructive waits for your “Allow”.

Download for macOS Try it here ↓
  • Runs on your machine
  • Keys in the Keychain, not in files
  • macOS, Windows, Linux

your projects × your toolsthread on top — tool available

Claude Code in ~/work/forkway gets github, postgres (DELETE asks you first), sentry and slack. jira doesn’t exist for it. Keys come from the Keychain.

Works with any MCP client

  • Claude Code
  • Codex
  • Cursor
  • VS Code
  • Gemini CLI

Try it

Be the human the agent has to ask

The agent runs in bypass mode — the terminal never asks. toolwrap lets safe calls through silently and brings risky ones to you. Start the agent and make the calls.

  1. ~/work/forkway $ claude --dangerously-skip-permissions
  2. › fix release 2.4.1 and merge the fix

The agent has a task. Let’s see when it needs you.

Went through on their own: 0Asked you: 0

What changes

Before and after, one line per pain

For people with 5–15 projects, people who run agents unattended, and people who lead a team.

  • Tokens sit in every project’s .mcp.json — and in git history.

    Keys live in the Keychain. The client config gets one line: mcphub-bridge --set alpha.

    everyone

  • The agent in client Alpha’s folder files a ticket in client Beta’s Jira.

    The folder picks the set: ~/work/alpha only has Alpha’s Jira.

    many projects

  • An agent in bypass mode can delete data or merge a PR while you get coffee.

    A risky call waits for you in a card on top of all windows. No answer in 4 minutes — denied.

    unattended agents

  • The agent edits its own config to lift the limits in its way.

    An edit that weakens protection waits for your “Apply”. Until then, the old policy holds.

    unattended agents

  • 60 tools with weak descriptions — the agent gets confused and burns context.

    Noise switched off, project = ALPHA pinned, descriptions rewritten — and you see the token cost.

    many projects, teams

  • A token expires — you learn it from an agent that already worked around it.

    A dot on the set in the tray, and “Update token” opens the right form.

    everyone

  • Everyone on the team sets up MCP their own way.

    The set file lives in the repo: descriptions and rules are shared, keys stay personal.

    teams

  • What the agent did overnight is anyone’s guess.

    Every call is logged with its arguments; secrets are redacted.

    unattended agents, teams

How it works

One file per project. One MCP server for the agent.

A set is a TOML file in ~/.mcphub/sets. toolwrap launches the servers it lists, injects the set’s keys, applies your edits and exposes the result to the agent as a single MCP server. Everything in the window is also in the CLI.

~/.mcphub/sets/alpha.toml
[servers.jira.env]
JIRA_URL = "https://alpha.atlassian.net"
JIRA_TOKEN = "secret:alpha/JIRA_TOKEN"   # the value is in the Keychain

[servers.jira.tools.search]
pin = { project = "ALPHA" }
description.append = "Always search only in project ALPHA."

[servers.jira.tools.delete_issue]
enabled = false

[servers.db.tools.query]
confirm = "when"                   # risk is a property of the call
when = [{ arg = "sql", not_matches = "^\\s*(select|with|explain)\\b" }]

[[context.source]]
type = "files"
globs = ["docs/ARCHITECTURE.md"]
terminal
# move servers out of Claude Code and Codex
$ mcphub adopt ~/work/alpha --apply --remove

# a new project
$ mcphub set create beta
$ mcphub server add jira --set beta --secret JIRA_TOKEN
$ mcphub link ~/work/beta --set beta

# rules and checks
$ mcphub tool confirm beta github merge_pull_request always
$ mcphub preview beta     # what the agent sees
$ mcphub log --set beta
$ mcphub doctor

One server per set

Clients see a set as one MCP server: over stdio through mcphub-bridge, or HTTP on 127.0.0.1.

Processes by credentials

Ten sets on one Jira account share one process; different keys get different processes; share = root gives each worktree its own.

Edits live in the gateway

Rewrite descriptions, pin arguments, hide tools, prompts and resources — without forking a server.

Project context first

Text, files, a command or a tool call — the agent gets it at the start of the session, unasked.

Security model

The agent does the work. The rules stay yours.

  • Local only

    The daemon listens on a local socket or named pipe; HTTP binds to 127.0.0.1. No cloud, no account.

  • Secrets in the OS keychain

    Keychain, Credential Manager or Secret Service. Config files only hold references like secret:alpha/JIRA_TOKEN.

  • Approval in any client mode

    toolwrap asks even when the agent runs in auto, bypass or yolo mode, or the client allows every tool.

  • Answers only from the window

    An approval counts only in toolwrap’s own card — not in the terminal the agent controls.

  • Weakening is held

    Lifting an approval, enabling a disabled tool, turning the gate off or adding a server waits for a human “Apply”.

  • A log with redacted secrets

    Every call with its arguments and outcome — filter by set, server, failures and approvals.

Get started

Three steps. The agent won’t notice.

  1. Install the app

    toolwrap lives in the menu bar and updates itself when you click “Update”.

  2. Import from clients

    Servers from Claude Code and Codex move into sets, keys into the Keychain — and out of config files.

  3. Keep working

    The agent opens the same folder and gets its set. You only decide what matters.

FAQ

Frequently asked questions

What is an MCP gateway?

An MCP gateway sits between AI clients and MCP servers. Instead of configuring every server in every client, you connect the client to the gateway once, and the gateway decides which servers, credentials and rules apply to each project.

Which clients does toolwrap work with?

Any MCP client: Claude Code, Codex, Cursor, VS Code, Gemini CLI. Stdio clients connect through mcphub-bridge, others over HTTP on 127.0.0.1. Existing servers can be imported from Claude Code and Codex.

Where are tokens and API keys stored?

In the OS secret store: Keychain on macOS, Credential Manager on Windows, Secret Service on Linux. On import, toolwrap removes tokens from client configs; the call log redacts secrets.

Can the agent turn approvals off by itself?

No. An edit that weakens protection — in the set file, through the CLI or by adding a server — is not applied until a human clicks Apply in the toolwrap window. Until then the previous policy holds.

What happens if I am away from the computer?

The approval card waits 240 seconds, then the call is denied and the model gets a clear reason. Nothing risky runs without a human.

Do I need to change my MCP servers?

No. toolwrap runs ready-made servers — an npx or uvx command, a binary or a remote URL — and has no integrations of its own. Description edits and pinned arguments are applied by the gateway, not the server.

Is there a cloud or sync?

No. The daemon runs on your machine and listens on a local socket. To move sets to another machine or share them with a team, export them to a file.

Your tools, woven into one set — each one still itself.

Download toolwrap, import your servers from Claude Code and Codex, and let the agent work.

macOS Windows Linux · AppImage, deb

No cloud, no chat of its own, no marketplace. Just the gateway — that’s why it’s light.