Agent Tools

Tools that give AI coding agents controlled access to external services while keeping service credentials on the host.

Use your preferred agent harness and client environment. Agent Gateway governs MCP tools, HTTP/HTTPS requests and configured smart-HTTPS Git repositories/refs. Its Git proxy works with native HTTPS Git clients and does not use host credential helpers. Gateway does not require retired tools, Sandbox Manager or Lima. Existing Local Git MCP and TypeSafe MCP users should follow the manual replacement paths.

agent-gateway provides a local MCP endpoint and HTTP/HTTPS forward proxy with separate agent identities and scoped access controls.

• Denies access unless granted for MCP tools, with scoped permissions that agents can request through self-service tools.
• Controls HTTP/HTTPS traffic with separate per-agent defaults and grants, supporting HTTPS interception, credential injection, and opaque tunnels.
• Authorizes supported smart-HTTPS Git reads and ref actions with independent repository grants and Git-only credentials; SSH and LFS are outside that integration.
• Manages upstream credentials and OAuth; agents receive a separate Gateway credential, not upstream service secrets.
• Provides a web application and CLI for administration, with optional bounded MCP, HTTP and Git traffic history plus separate control-plane audit records.

See the Agent Gateway README for setup and usage.

Source retirement does not uninstall binaries, remove configurations or credentials, rewrite remotes, or migrate installed clients. Preserve historical evidence and plan any live cutover separately. Git history below retains the final source; no replacement MCP shim is provided.

• Local Git MCP → native Git through Gateway: follow Git setup to configure smart-HTTPS repositories, read/ref grants, protected Git-only upstream credentials, routing and client proxy/CA trust. This replaces the supported HTTPS access path, not the former MCP commands, SSH transport or host credential-helper behavior. Inspect existing remotes and client settings before a deliberate manual change; do not silently rewrite them. Start with the guide's read-only ls-remote check, not a push.
• TypeSafe MCP → direct API/SDK through Gateway: follow TypeSafe HTTP setup. Credential injection replaces upstream secret custody, not the evaluate/list_models MCP interface or its typed contract. Callers must implement the current API/SDK requests, validation and error handling, and configure supported proxy/CA behavior. Keep real TypeSafe keys in protected Gateway custody, never agent/client environment variables or source. Setup and source tests do not qualify live adoption or authorize paid inference.

Requirements:

• Go 1.26.9 or later and GNU Make
• For Agent Gateway, a Linux or macOS host; agent-gateway init creates the owner-only data directory and protected master key for a new installation

From the repository root, run the install command for the tools you need:

make -C agent-gateway install

Or install all tools:

make install

Each tool's README covers its configuration and runtime requirements.

In addition to the installation requirements, development uses Node.js/npm for hooks and formatting, and Python 3 for CI selection and gate tests.

npm install  # install development dependencies and Git hooks
make build  # build all Go tools
make check  # check CI selection, formatting, lint, and ordinary tool correctness

make setup combines development dependencies and installation of all tools.

See the contributor guidance for focused checks and CI requirements.

• agent-config — My configuration for working with AI coding agents

MIT