tool-control-planeBLOCK
The unglamorous half of agent tooling: a gRPC control plane for sessions, machines, fenced writes, and capability-scoped keys. HTTP and MCP gateways; Python, TypeScript, and Go SDKs.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/Abhishek-chohan/tool-control-plane/actions/workflows/lint.yml) [](https://github.com/Abhishek-chohan/tool-control-plane/actions/workflows/proto-drift.yml) [](https://github.com/Abhishek-chohan/tool-control-plane/actions/workflows/conformance-python.yml) [](https://github.com/Abhishek-chohan/tool-control-plane/actions/workflows/release-gate.yml) [](LICENSE)
Toolplane is a gRPC control plane for tool execution that has to outlive the caller that started it. It owns the request lifecycle — durable requests, provider machine ownership with leases and heartbeats, bounded stream replay after disconnects, and drain-safe rollouts — so callers don't rebuild that machinery around every remote tool.
A model being able to call a tool is not a reason to use Toolplane. If the work is quick, in-process, and shares the caller's lifecycle, call it directly.
Status
Pre-1.0 and under active development — expect breaking changes. The wire contract is versioned: api.v1 is the compatibility boundary per the compatibility policy. The first tagged release is v0.1.0; notable changes land under CHANGELOG [Unreleased] between tags.
The release artifacts are published from the tag:
pip install toolplane-python-client==0.1.0 # SDK + toolplane-provider CLI npm install [email protected] docker pull ghcr.io/abhishek-chohan/toolplane-server:v0.1.0 go get git
e0276251ce9dOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add toolplane-typescript-mcp-adapter --env TOOLPLANE_API_KEY=${TOOLPLANE_API_KEY} --env TOOLPLANE_AUTH_FIXED_API_KEY=${TOOLPLANE_AUTH_FIXED_API_KEY} --env TOOLPLANE_AUTH_MODE=${TOOLPLANE_AUTH_MODE} --env TOOLPLANE_CONFORMANCE_API_KEY=${TOOLPLANE_CONFORMANCE_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"toolplane-typescript-mcp-adapter": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"TOOLPLANE_API_KEY": "${TOOLPLANE_API_KEY}",
"TOOLPLANE_AUTH_FIXED_API_KEY": "${TOOLPLANE_AUTH_FIXED_API_KEY}",
"TOOLPLANE_AUTH_MODE": "${TOOLPLANE_AUTH_MODE}",
"TOOLPLANE_CONFORMANCE_API_KEY": "${TOOLPLANE_CONFORMANCE_API_KEY}"
}
}
}
}Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
change_summary | read | Build a concise summary for a rollout or change event |
echo_tool | read | Echo the caller message back from the maintained TypeScript provider runtime |
incident_brief | read | Generate a brief operator-facing incident summary |
session_status | read | Report session context for a connected operator or automation client |
stream_tool | read | Stream tool |
toolplane-mcp-concept-map | read | Native versus translated semantics for the optional MCP adapter |
updated | read | refreshed |
Trust audit
BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
return Function('return this')();return Function('return this')();return Function('return this')();TOOLPLANE_PROXY_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://localhost:8080
TOOLPLANE_DATABASE_URL: postgres://postgres:postgres@localhost:5432/toolplane?sslmode=disable
TOOLPLANE_DATABASE_URL: "postgres://postgres:postgres@localhost:5432/toolplane?sslmode=disable"
TOOLPLANE_DATABASE_URL: "postgres://postgres:postgres@localhost:5432/toolplane?sslmode=disable"
TOOLPLANE_DATABASE_URL: "postgres://postgres:postgres@localhost:5432/toolplane?sslmode=disable"
cd server && TOOLPLANE_DATABASE_URL=postgres://toolplane:toolplane@localhost:5432/toolplane?sslmode=disable make release-gate
client.apiKey = "transport-auth-token"
.golangci.yml
.flake8
.mypy-baseline
.env.test.example
.eslintrc.cjs
cp ../../LICENSE .
cp ../../LICENSE .
import * as google_api_http_pb from "../../google/api/http_pb";
var google_api_http_pb = require('../../google/api/http_pb.js');} from '../../../src/proto/proto/service_pb';
health_url = f"http://127.0.0.1:{http_port}/health"mcp_health_url = f"http://127.0.0.1:{mcp_port}/health"if (!(await waitForHTTPHealth(`http://127.0.0.1:${httpPort}/health`, BOOTSTRAP_READINESS_TIMEOUT_MS))) {const gatewayURL = `http://127.0.0.1:${gatewayPort}/mcp`;googleapis-common-protos, requests, typing-extensions, pydantic, pytest, pytest-cov, black, isort
Gates applied: no_behavioural_pass.
e0276251ce9dfull audit observations/trust-audit/mcp-server/abhishek-chohan__tool-control-plane.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | e0276251ce9d | BLOCK | F | 55 | first audit |
Questions
What is the tool-control-plane MCP server?
The unglamorous half of agent tooling: a gRPC control plane for sessions, machines, fenced writes, and capability-scoped keys. HTTP and MCP gateways; Python, TypeScript, and Go SDKs.
What tools does tool-control-plane expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is tool-control-plane safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (55/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does tool-control-plane need?
It reads TOOLPLANE_API_KEY, TOOLPLANE_AUTH_FIXED_API_KEY, TOOLPLANE_AUTH_MODE and TOOLPLANE_CONFORMANCE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does tool-control-plane run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as toolplane-typescript-mcp-adapter at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (e0276251ce9d), read on 2026-10-12. The repository is watched and re-audited when it changes.