A local-first permission firewall and approval layer for AI agent tool calls.
ToolPermit is a local-first permission policy, one-time approval, and redacted audit layer for Model Context Protocol (MCP) tool calls. Put it between a local MCP client and a stdio server to observe calls, enforce explainable allow / ask / deny rules, review exceptional actions, and replay recorded calls against a candidate policy.
Current release: v0.1.1 on PyPI, with a matching GitHub Release.
English is authoritative for project contracts. See README.zh-CN.md for the Chinese feature overview and quickstart.
- Deterministic policy: strict, versioned YAML; first match wins and every result explains why. - Exact one-time approval: an approval is bound to the canonical request, policy, session, and expiry, then consumed atomically. - Redaction before storage: recognized secrets and sensitive keys are irreversibly replaced before SQLite persistence, display, or JSONL export. - Offline replay: compare policies against stored, redacted calls without starting the MCP server or executing a tool. - Local interfaces: every core workflow is available from the CLI; the optional approval UI is restricted to loopback and protected by Host, Origin, CSRF, CSP, and SameSite controls. - Portable core: tested on Ubuntu, macOS, and Windows with Python 3.11, 3.12, and 3.13.
Install the ToolPermit Codex Skill from this GitHub repository with the built-in plugin manager:
For a reproducible installation of this release, replace main with v0.1.1 in the first command.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/sunhao123456sun-svg--toolpermit.html)
Claude Code & Codex plugin for the open-source ArtCraft Craft App Suite: one craft Skill drives 12 local, headless Craft MCP apps (photo, vector, video, RAW, PDF, layout, sheets, docs, slides, CAD, au
sgateway/s-gwLocal credential control for AI coding agents.
Shalimov04/mcp-airlockStateless governance proxy for MCP (2026-07-28): policy, dry-run, human confirmation, audit, tracing
korovin-aa97/talkthrough-mcpMCP server: turn narrated screen recordings into agent-ready data — local Whisper transcript, scene keyframes, OCR, wall-clock anchoring. Record your screen, talk — your AI agent files the bugs.
signerless/tolpoLocal-first HTTP API and MCP server that lets AI agents read and control TP-Link Tapo smart-home devices
Icaro0310/poordjaevinDjævin: calibrated local-first decision layer with a Devin ACP backend - no API key needed
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.