Toolkien
Sign in Get started

Free during the early phase

One MCP to rule them all.

Connect one MCP server to Claude, Codex or Cursor and use every remote MCP server you configured. Your agent discovers tools on demand and writes code against typed functions, instead of drowning in tool schemas.

Get started Read the docs
What your agent runs
// The agent found these with tools_search, read their types with tools_describe,
// and runs them in one sandboxed script with execute.
const issues = await github.listIssues({ repo: 'acme/web', state: 'open' });
const urgent = issues.filter((issue) => issue.labels.includes('p0'));

await slack.postMessage({
  channel: '#triage',
  text: `${urgent.length} urgent issues today`
}); // "ask" permission: you approve this call first

Code mode

One tool to find them, one sandbox to run them.

Three tools do the work. The agent only loads what it needs, so long tool lists stop eating its context.

  1. 1

    Search

    The agent looks for tools by text in your active workspace and gets paths with a one-line summary, not hundreds of schemas.

    tools_search
  2. 2

    Describe

    It reads the TypeScript declarations of the few tools it needs, generated from each server’s schemas.

    tools_describe
  3. 3

    Execute

    It runs one script in an isolated Deno sandbox. Every call goes through permissions; writes can wait for your approval.

    execute

Security

Built to be trusted with your accounts

Toolkien sits between your agent and your services. It keeps only what it needs: accounts, encrypted credentials, configuration and metadata logs.

  • Encrypted credentials

    Upstream tokens are sealed with AES-256-GCM and a per-workspace key wrapped by OpenBao. A stolen database reveals no token.

  • Sandboxed scripts

    A fresh Deno process with no permissions per execution: no network, no environment, no filesystem. Only the tools you allowed.

  • Permissions and approvals

    Allow, ask or block per tool. Writes ask by default and approvals come only from you, never from the model.

  • No token passthrough

    The token your client holds is never forwarded upstream. OAuth 2.1 with PKCE, audience-bound short-lived tokens.

  • Egress control

    Upstream calls leave through a dedicated proxy, https only, with private and metadata addresses blocked.

  • Metadata-only logs

    Who did what and when, never arguments, results or script code. Kept 90 days, then deleted.

For teams

Shared connectors, without sharing tokens

  • Company workspaces

    Invite your team with a link. Admins connect shared accounts once; members use them without seeing a token.

  • Admin policy

    Allowed servers, minimum permissions members cannot loosen, and whether personal connectors or free URLs are allowed.

  • Roles and activity

    Owner, admin, member. Everyone sees their own timeline; admins see all of it and export CSV.

  • Kill switch

    Stop a workspace in one click: running executions end, tokens are suspended, configuration stays.

Open source

Prefer to run it yourself?

Toolkien is open source under AGPL-3.0. The managed service is the easy path; self-hosting gives you the same product on your own server: one Docker Compose stack (app, OpenBao, egress proxy, runner), ready for Coolify.

Source code Self-hosting guide

Connect once. Call them all.

One connection per client. Switch workspaces when you ask to, and always see where your agent is operating.

Create a free account Documentation