Security at the gateway

Your agent's tools are a trust boundary. Toolport guards it.

Every MCP call routed through Toolport passes one local gateway. That puts Toolport on the path to check the tool definitions coming in and the results going back, and to flag the attacks that target agents. Calls made by clients that bypass Toolport are outside what it can see.

Download free Read the code

What it checks

Six ways agents get hurt, and what Toolport does.

Each check runs on your machine with no cloud calls. Findings show up in the app's Activity view.

AttackWhat it isWhat Toolport does

Tool poisoning / line jumpingHidden instructions smuggled into a tool's description or schema, which the agent reads and may act on before it ever calls the tool.Toolport scans every tool definition for injection signatures (instruction-override, stealth directives, embedded commands, hidden Unicode) when a server first connects and whenever a definition changes, and flags it in Activity.

Rug pullA tool you already reviewed and approved is silently swapped for a malicious version later, after it has earned your trust.Toolport fingerprints every tool on connect and flags any later change to an approved tool's definition, or a new tool a known server quietly adds. The classic rug-pull signature, caught before you trust it again.

Agentjacking (indirect prompt injection)Untrusted content returned by a tool (a Sentry error, a GitHub issue body, a web page, a DB row) carries instructions the agent follows as if they were yours.Toolport scans tool results for injection patterns and records findings in Activity. Results reach the agent exactly as the server sent them. In Strict mode, a high-confidence finding blocks the result.

Plaintext secretsAPI keys and tokens sitting in agent config files in the clear, readable by any process or backup on the machine.Toolport holds secrets in the OS keychain and injects them at runtime. Each key is sent only to the server it belongs to, and your agent's config only points at Toolport, so keys never land in an agent's JSON.

Over-permissioned agentsAn agent reaches a delete, drop, or write tool you never meant to expose, and every step is technically authorized.One switch hides and blocks every tool a server annotates as destructive, across every connected server at once. Per-tool deny too.

No audit trailYou can't see what your agent actually did across all those tools, so you can't review, prove, or govern it.Toolport keeps a rolling local audit log of the last 5,000 managed tool calls routed through it, with per-server latency and error rates. It records the tool, time, duration and outcome, and an argument hash rather than the arguments.

We scanned the official MCP registry to see how often tools change and how much is poisoned.

One safety setting

Off, ask, or strict.

One setting replaces the old toggles. The middle one is the default: Toolport asks before a tool marked destructive runs. Upgrading from 1.x keeps any stricter protection you had turned on.

OffAsk before destructiveStrict

With Teams

What a team shares.

Teams syncs the server list, who can use which servers and tools, and a team policy that can only tighten each person's own settings. Toolport stores upstream credentials in each person's OS keychain and sends them to their configured upstream server when needed. Teams is designed to sync configuration and credential references, not upstream credential values. It strips recognized secret fields and rejects known secret patterns; do not paste secrets into shared commands, URLs or instructions.

Cooperative enforcement. Team policy is applied by each person's Toolport. It covers calls that go through Toolport; a machine that is not running Toolport is outside it, and policy reports are what each app says it applied, not device attestation.

What syncs to each teammate

synced  servers, access, policy
local   upstream credentials
# do not paste secrets into shared commands, URLs or instructions
# each person signs in on their own machine

Honest about scope

What this is, and what it isn't.

Detection first

On tool results, Toolport flags and labels rather than silently dropping or rewriting your data, so a false flag cannot break your work. Blocking is yours to turn on: hide or disable destructive tools, quarantine a tool whose definition changed, or require approval before a call runs.

Local and deterministic

Scanning happens on your machine with no cloud calls. Secrets stay in your OS keychain.

Heuristics, not a guarantee

The checks catch common and moderately sophisticated attacks. A determined attacker can still obfuscate their way past them. We say so rather than overclaim.

MCP, not your shell

Toolport sees tool calls and results. Code an agent runs through its own shell is not an MCP call, so it is outside what any gateway can watch.

Found a security issue? Report it privately through a GitHub security advisory and we will respond before any public disclosure.

Free on this machine. Pro puts it on every machine. Team gives it to everyone.

Download free See Pro and Team