ToolGate

The one door between an AI agent and the outside world.
Typed tools, exact single-use approvals, spending limits and a receipt for everything.

ToolGate is a self-hosted control plane for what an agent may do. The agent never holds provider credentials and never runs code of its own. It calls typed capabilities with a scoped key, and ToolGate checks policy, asks the owner when needed, runs the action, and records the outcome.

It is part of Conker, a personal AI companion you host yourself, and it works on its own with any agent.

Where it fits

flowchart LR
    Agent[Agent<br/>e.g. Conker's Pi] -->|scoped key| TG[ToolGate]
    Owner([Owner]) -->|approve once| TG
    TG --> Vault[(Encrypted vault)]
    TG --> APIs[Public APIs<br/>and research]
    TG --> Local[Local models<br/>and services]
    TG --> MG[MemoryGate<br/>read-only]
    classDef focus fill:#e36b2c,color:#fff,stroke:#b4521f
    class TG focus

Loading

What it does

Object	What it is
Service	A provider identity with write-only secrets, destination policy and health.
Tool	One atomic, typed operation run by a restricted executor. Tools cannot call other tools.
Automation	A versioned, deterministic workflow of tools and bounded control blocks.
Request	Something waiting for the owner: a verification, warning, proposal or update.

• Approvals are exact. An approval binds the object, version, argument digest and nonce. A request waits for the owner as long as it takes; their yes opens a 15-minute window for that exact action to run once. A replay or a changed argument fails closed. (details)
• Access follows the owner. Who may decide each action comes from the owner's settings (the chat, the agent, the tool). A floor of actions always asks the owner, and each agent sees and runs only its own toolkit. (details)
• Secrets stay put. Vault values are write-only and encrypted at rest. No API returns one.
• Money has ceilings. Paid routes stay off until prices, limits and a job are configured. An interrupted call is held as outcome_unknown, never retried blindly. (details)
• Health is real. /health probes every dependency and says degraded when one fails.
• No code on the host. Executors are a fixed set: HTTP JSON, research search and fetch, MemoryGate reads and bounded model calls. The agent's Terminal runs each command in a fresh, locked-down container with no network; package installs reach PyPI and npm only through a read-only proxy. (details)

Quick start

Requires Docker with Compose. Published images: ghcr.io/conker-ai/toolgate and ghcr.io/conker-ai/toolgate-sandbox.

cp toolgate/.env.example toolgate/.env
docker network create conker_net        # once; shared with the other Conker services
cd toolgate && docker compose up -d --build

Open the dashboard at http://localhost:8011; the API is on http://localhost:8010. Control keys are generated on first start and never logged. Read them once from toolgate/.env, then protect that file. Back up the vault key with the data: deployment guide.

Using it from an agent

toolgate tool list
toolgate tool research.search --action-id plan-42 --query "judo clubs near me"

The CLI needs only the Python standard library and a scoped key. An opt-in MCP bridge enforces the same scopes and approvals. See agent access.

Security model, briefly

• Agents use rotatable execution keys with explicit scopes. Management needs a separate admin key.
• Lockdown stops agent execution, new requests and callbacks in one switch.
• Research never takes a URL from the agent. It fetches only server-issued handles, rejects private and metadata destinations at the socket, and marks fetched text as untrusted.
• Logs and responses carry references and redacted outcomes, never secret values.

ToolGate reduces agent and prompt-injection risk; it cannot protect a host that is already compromised. Keep the API private. Full model: security.

Development

pip install -r toolgate/requirements.txt pytest httpx
python -m pytest toolgate/tests --ignore=toolgate/tests/test_module_contract.py -q
python toolgate/scripts/mutation_check.py     # proves the tests catch broken behaviour

More, including the live boundary verifier: testing.

toolgate/api/        FastAPI app; one router per area in api/routes, automation runtime
toolgate/core/       SQLite control plane, policy, vault
toolgate/executors/  Research, sandbox, system and container adapters
toolgate/cli/        Standard-library agent CLI
toolgate/mcp/        Opt-in authenticated MCP bridge
dashboard/           React owner dashboard

Documentation

Using it

Security model	Scopes, vault, approvals, research boundary, callbacks
Access policy	Who may decide each action, and the floor that always asks
Agent access	Agent identities, the CLI and the MCP bridge
Agent sandbox	Terminal and Install packages in locked-down containers
Automations	Workflows, revisions, publication, nested runs
Workflow editor	Checking a document, publishing with Conker's access
Owner channel	The browser gateway's own bounded credential
Authenticated MCP	The opt-in MCP transport

Money and outcomes

Durable execution and spending	Action IDs, budgets, unknown outcomes
Recurring spending	Finite allowances for scheduled work
Approval integrity	How approvals are issued, bound and consumed

The machine

System inventory · Filesystem	Read-only views of the host
Containers · Services · Ports	Managed lifecycle actions, each behind approval

Running it

Deployment	Compose, vault key, health, upgrades
Testing	Suites, mutation check, live verifier
Recovery journal · Retiring cognition	Restore and upgrade notes
API (OpenAPI)	Full route reference

License

AGPL-3.0, version 3 only. Copyright (C) 2026 alexeybe1kin. Releases published before 24 October 2026 were under MIT and stay under MIT.