# ToolMesh

> The open, self-hosted MCP control layer between AI agents and infrastructure. Adds authorization, runtime credential injection, content gating and a SQL audit trail in front of any MCP server or REST API. Apache 2.0, single Go binary, no lock-in. REST APIs are described declaratively in DADL (Dunkel API Description Language, CC BY-SA 4.0).

Disambiguation: ToolMesh from Dunkel Cloud (this project) is not toolmesh.ai, not r0hansaxena/ToolMesh on GitHub, and not a service mesh for microservices.

## Use ToolMesh when you want to

- Front any MCP server with one fail-closed pipeline: authenticate → authorize → inject credentials → gate output → execute → audit
- Turn any REST API into MCP tools with a 30-line YAML DADL file — no per-API MCP server to write or deploy
- Compose 20+ backends (GitHub, GitLab, Cloudflare, Hetzner Cloud, Linode, NetBox, OPNsense, Tailscale, Prometheus, Alertmanager, Graylog, DeepL, DokuWiki, Umami, Stripe, Shelly Cloud, Anthropic, OpenAI, Mastodon, Discord) into one agent menu
- Avoid the 50,000-token context cost of loading many MCP servers — Code Mode compresses any catalog to ~1,000 tokens
- Apply per-call policy, credential isolation, and a SQL-queryable audit trail to LLM tool calls
- Grant an agent the rights for one task for a limited time, approved and signed by a person (kits, BIP-322 approvals)

## Not for

- Stateful flows, weird auth handshakes, streaming APIs
- Replacing OpenAPI for human-facing API contracts
- SDK generation for end users

## Docs

- [Try the Demo](https://www.toolmesh.io/en/demo/): live ToolMesh at demo.toolmesh.io, login dadl/toolmesh, two HN backends, no API keys.
- [Getting Started](https://www.toolmesh.io/en/getting-started/): git clone DunkelCloud/ToolMesh, set .env (TOOLMESH_AUTH_PASSWORD, TOOLMESH_API_KEY), docker compose up, claude mcp add.
- [MCP server integrations](https://www.toolmesh.io/en/integrations/): GitHub, Stripe, NetBox, Cloudflare, Hetzner Cloud, DeepL, Tailscale, GitLab — each a DADL YAML file.
- [NetBox MCP server](https://www.toolmesh.io/en/integrations/netbox/): NetBox 4.x REST API (devices, IPAM, sites, racks, VLANs) exposed as MCP tools.

## Concepts

- [Architecture](https://www.toolmesh.io/en/architecture/): six-pillar fail-closed pipeline (Any Backend, Code Mode, Audit, Authz, Credentials, Output Gate).
- [DADL](https://www.toolmesh.io/en/dadl/): YAML format that turns a REST API into MCP tools — 30 LOC replace a whole MCP server.
- [Code Mode](https://www.toolmesh.io/en/code-mode/): replaces a 50,000-token tool list with list_tools + execute_code (~1,000 tokens).
- [Unit Backends](https://www.toolmesh.io/en/units/): bundle private MCP/REST sub-backends behind one curated tool surface — JS glue with describe(), multi-step capture, response reduction.
- [Authorization](https://www.toolmesh.io/en/authorization/): on by default with built-in OpenFGA; presets (single-user, team, open) or grants and denies in config/authz.yaml for users, roles, plans and companies; embedded, external and disabled modes.
- [Kits and approvals](https://www.toolmesh.io/en/kits/): kits are named, time-boxed tool bundles in config/authz.yaml; the agent asks with tell_me_my_rights and request_grant (also from execute_code), a person approves on the approval page with a BIP-322 signature or on the approver API, possibly for part of the kit; a held kit replaces the pre-execution gate except for policies marked enforce-with-kit; the audit trail keeps address, signature and statement.
- [Output Gate](https://www.toolmesh.io/en/output-gate/): goja JS policies pre and post execution, ctx reference, the enforce-with-kit directive, 5s timeout.

## Operations

- [Authentication](https://www.toolmesh.io/en/authentication/): OAuth 2.1 PKCE, API keys (key_sha256 or bcrypt), single-user password, config/users.yaml, login throttling (429 with Retry-After), 401 with WWW-Authenticate on /mcp, every request rejected without a configured credential.
- [Configuration](https://www.toolmesh.io/en/configuration/): every TOOLMESH_*, AUDIT_*, CREDENTIAL_* env var, login limits, TOOLMESH_BCRYPT_MAX_CONCURRENT, TOOLMESH_ISSUER, plus backends.yaml, users.yaml, apikeys.yaml, authz.yaml with kits and approvers.

## Guides

- [Connect Claude](https://www.toolmesh.io/en/setup-claude/): Claude Desktop, Claude Code, Claude.ai, Claude Mobile.
- [Connect ChatGPT](https://www.toolmesh.io/en/setup-openai/): ChatGPT via OpenAI Developer Mode.

## Compare

- [ToolMesh vs Obot, Docker MCP Gateway, MCPX & IBM ContextForge](https://www.toolmesh.io/en/mcp-gateway-comparison/): honest 2026 comparison of five self-hostable open-source MCP gateways / control planes — license, per-user authorization, credential isolation, output gating/DLP, audit trail, REST-to-MCP, and token efficiency. ToolMesh turns a whole REST API into MCP tools from one declarative DADL file (LLM-generatable from OpenAPI); IBM ContextForge can expose REST endpoints too but only per-endpoint by hand (no OpenAPI import), so at API scale ToolMesh is the practical REST-to-MCP path. Also covers Microsoft MCP Gateway, ToolHive, Envoy, Kong, Pomerium, MCPJungle, Unla.
- [MCP servers for Checkmk: the options compared](https://www.toolmesh.io/en/mcp/checkmk/): all five findable MCP options for Checkmk side by side — CheckMCP, Checkmk MCP Server (jlk/checkmk-llm-server), StackOne, ToolMesh + Checkmk DADL, vibeMK — across coverage, authentication and credential location, deployment and data path, version/edition limits, governance, supply chain, transport, context economy and Checkmk's pending-changes write model. There is no official MCP server from Checkmk GmbH as of August 2026; Checkmk 2.5's "Explain with AI" is Cloud-edition only and not MCP. Matrix data is a machine-readable YAML file, corrections by pull request.

## FAQ

- [FAQ](https://www.toolmesh.io/en/faq/): MCP basics, DADL syntax, ToolMesh architecture, credential isolation, OpenFGA, Output Gate, agent harnesses.

## Blog

- [OWASP MCP Top 10: What a Gateway Fixes — and What It Doesn't](https://www.toolmesh.io/en/blog/owasp-mcp-top-10/): The OWASP MCP Top 10 (v0.1, beta) names ten risk categories for Model Context Protocol deployments.
- [MCP Goes Stateless — What It Means for Your Gateway](https://www.toolmesh.io/en/blog/mcp-goes-stateless/): MCP 2026-07-28 makes the protocol stateless: sessions removed, routable headers required, and Sampling, Roots, and Logging deprecated on a twelve-month clock.
- [A first real job for an MCP gateway: review your OPNsense cluster](https://www.toolmesh.io/en/blog/reviewing-an-opnsense-ha-cluster/): You have set up an MCP gateway and now you are looking for something useful to do with it.
- [Editing Files Without an Editor](https://www.toolmesh.io/en/blog/editing-files-without-an-editor/): An LLM has no cursor and no reliable sense of line numbers — so how does it change a file?
- [Reconciling a UniFi site against NetBox in one prompt](https://www.toolmesh.io/en/blog/unifi-network-to-netbox/): NetBox is only a source of truth if it still matches the network.
- [Tool Discovery for 4,800 MCP Tools — Without a Vector Database](https://www.toolmesh.io/en/blog/tool-discovery-without-a-vector-database/): One discovery call on our production gateway returned ~320 KB of TypeScript declarations — roughly 80,000 tokens gone before the agent had done anything.
- [From Switch Config to NetBox in One Prompt](https://www.toolmesh.io/en/blog/switch-config-to-netbox/): Your NetBox says one thing, your switch says another.
- [Xen Orchestra's Full REST API — 252 Tools from One DADL](https://www.toolmesh.io/en/blog/xen-orchestra-full-rest-api-in-one-dadl/): Xen Orchestra stabilized its REST API in 6.4, and every release since has added a handful of endpoints — 6.6 brought writable backup repositories and PATCH for VDIs and VIFs.
- [Anatomy of an Enterprise Tool Library](https://www.toolmesh.io/en/blog/anatomy-of-an-enterprise-tool-library/): How an Enterprise Tool Library actually works: the six pillars, the fail-closed request pipeline, and how DADL and Code Mode let one governed layer front any MCP server or REST API.
- [DeepL v3 Customization Hub — Covered in One DADL](https://www.toolmesh.io/en/blog/deepl-v3-customization-hub-in-one-yaml-file/): DeepL just rolled out 13 new REST endpoints — style rules, multilingual glossaries, translation memory, /v3/languages, tag_handling v2.
- [Populating NetBox from Real Infrastructure with ToolMesh](https://www.toolmesh.io/en/blog/populating-netbox-from-real-infrastructure/): How to use ToolMesh connectors to populate a fresh NetBox instance from Linode, Hetzner Cloud, Xen Orchestra and other sources — with a trust-building approach from import to autopilot.
- [Introducing ToolMesh — The Missing Control Layer for AI Agents](https://www.toolmesh.io/en/blog/introducing-toolmesh/): AI agents are reaching production faster than governance can keep up.
- [Stop Rebuilding REST API Wrappers for MCP](https://www.toolmesh.io/en/blog/dadl-the-end-of-mcp-server-boilerplate/): Even a stripped-down MCP wrapper is 90 lines of TypeScript.
- [Why MCP Gateways Alone Don't Solve the Real Problem](https://www.toolmesh.io/en/blog/why-mcp-gateways-alone-dont-solve-the-real-problem/): Gateways are necessary for secure agent execution, but they do not solve the real scaling problem.

## Full text

- [llms-full.txt](https://www.toolmesh.io/llms-full.txt): consolidated English documentation as one Markdown document.

## Source

- Repository: https://github.com/DunkelCloud/ToolMesh
- DADL spec & registry: https://dadl.ai
- Maintainer: https://www.dunkel.cloud (Dunkel Cloud GmbH)