The arsenal
Every tool is the same shape: a FastMCP server alone in its container, on a sealed network, with its own egress allowlist and its own subdomain. The tools differ; the guarding never does. Here's what each one can actually do — and what keeps it in its box.
Production set
Your Google account, as tools
Gmail · Drive · Calendar · Docs · Sheets · Slides · Tasks · Apps Script
121 tools across your entire Google account. It sends the mail, shares the Drive file, and can run Apps Script — real code, as you.
A real browser, watched live
headed Chromium · noVNC takeover · any web UI
The full Playwright surface driving a real Chromium session. Anything with a web UI, navigated for you — with a live noVNC page to watch or grab the wheel. Logged-in sessions persist.
Your Telegram account as tools
read + write · DMs · groups · channels
The full Telegram surface, acting as you. Reads come free; writes send real messages from your number — so gate them in the panel.
The control plane
per-tool permissions · in-chat panel · approvals
The brake pedal. Set what each tool may do from the chat, and hold every write behind an approval card a human taps in person.
The incubator
beta-toolsExperiments live in a separate overlay repo and run on the same stack, the same wrapper.
Extend it
New tools are stamped from a template that arrives already wired into the substrate: an empty default-deny egress allowlist, locked dependencies, CI, and an opt-in compose profile.
./scripts/new-tool.shClone the stack, pick your profiles, and tell Claude Code to deploy it.
View on GitHub