caution · live access
Dangerous tools,
handled carefully.
Real accounts. A real browser. It actually sends the email. The sharp tools the big labs won't ship by default — self-hosted, best-effort guarded, and yours to run.
connected — your server
Book me a table for two, Friday 7pm.
browser.navigate — reservations
gatekeeper — approval
browser.form_submit — reserve 2 · fri 19:00
✓ approved — via telegram
Booked. The confirmation is in your inbox.
The sharp end
The best open-source engines, live-wired to your accounts.
workspace
Gmail, Drive, Calendar, Docs — as your account. Claude actually sends the email.
taylorwilsdon/google_workspace_mcp ↗browser
A real browser on your server. Anything with a web UI, navigated for you — on a schedule if you like.
microsoft/playwright-mcp ↗gatekeeper
The always-on control plane. Per-tool permissions, adjusted from the chat panel.
nativeArm it
Clone it. Tell Claude Code to deploy it.
git clone https://github.com/wnkinc/claude-custom-connector-server.git mcp-tools && cd mcp-tools && claude then say: "deploy this" — local or cloud, Claude walks the setup.
Best-effort guarding
Sharp tools need guard rails.
Real access is a real risk. The wrapper shrinks the blast radius.
- Auth in the server
- Google OAuth with a verified-email allowlist, failing closed. Auth travels with the image — desktop, web, mobile.
- Default-deny egress
- An isolated internal network. The single way out is a proxy with a per-tool domain allowlist.
- A guardrail that proves itself
- Output screening for prompt injection. At startup it must block a canonical injection before reporting healthy.
- No inbound ports
- A Cloudflare Tunnel fronts every tool over an outbound-only connection.