Toolport

A large security-hardening pass on the gateway, plus several features requested on the r/LocalLLaMA launch thread.

Highlights

• Concurrent HTTP gateway. Each request runs on its own worker, so a slow downstream server or a tool call held for human approval no longer blocks other requests, live setting toggles, or config reloads.
• Pi coding agent is now a supported client — one-click detect, import, and gateway install, same flow as Cursor and the rest.
• Pin a tool as a lazy-discovery prerequisite. A load-bearing tool (auth, list-before-act, or one whose description doesn't match the model's keywords) is always surfaced with its full schema, never hidden behind discovery.
• Tool identities (capability provenance). A new Activity panel shows what each model-visible tool name actually maps to: its source server, the profiles that enable it, the fingerprint drift detection checks against, and when it was first seen / last changed.
• Discovery panel. See exactly what lazy discovery searched and the tool-definition tokens it saved that turn versus loading the whole catalog. Because Toolport is in the request path, those figures are measured, not estimated.
• Teams can require human approval org-wide — a tighten-only policy that forces gated tool calls to be held for a person across every member's gateway.

Security

• Closed several code-execution bypasses in the stdio spawn guard (wrapper programs, Deno/Bun remote exec, unlisted interpreters, a node preload, and code-injecting env vars). Normal launchers like npx/node/python/docker are unaffected.
• Agent-control enable/disable now respects each client's scope, its "no match" error no longer lists other tenants' servers, and every toggle is audited with proof of the scope decision.
• fetch_result is now scoped to the client that produced the result, so result cursors can't be probed across clients.
• A malformed fetch_result can no longer crash the gateway, and the stdio transport now catches handler panics (defense-in-depth for the local transport).
• HTTP/OpenAPI clients are now scoped on resources and prompts too, not just tool calls.
• Closed three tool-supply-chain detection gaps (outputSchema poison-scan, structuredContent injection flagged, corrupt quarantine no longer fails open).
• The approval / confirm gate now fails closed on an unresolved tool, and the injection scan is bounded to 512 KB per result so a hostile server can't pin CPU.
• Registry durability + auth hardening: fsync before the atomic rename, empty Bearer rejected, constant-time per-client token check.

Changed

• Clearer client list and import view: connection state is the signal (import backlog moved to a badge), "Move config in" is the emphasized cutover action, and a note warns when importing into an already-connected client would load its tools twice.

Fixed

• macOS: monochrome menu-bar glyph (template image, tinted like every other menu-bar item), and the Dock icon now appears only while a window is open.
• Approval prompt is keyboard- and screen-reader-accessible, and its countdown is now exact (counts to the broker's real fail-closed deadline).
• Enable-all / Disable-all now respects the active search filter and can't be double-fired; the profile delete dialog names the profile.
• Activity and the sidebar now report the same tokens-saved figure (one shared formatter), a failed health probe no longer shows a green "Refreshed", and large fetch_result paging no longer re-scans the whole body per page.

Downloads

• macOS (Apple Silicon): Toolport_aarch64-apple-darwin.dmg
• macOS (Intel): Toolport_x86_64-apple-darwin.dmg
• Windows: Toolport_1.2.0_x64-setup.exe
• Linux: Toolport_1.2.0_amd64.AppImage or Toolport_1.2.0_amd64.deb

Full changelog: https://github.com/tsouth89/toolport/compare/v1.1.0...v1.2.0