Wraptool is a Go Model Context Protocol server for a specific deployment pattern: keep the harness and project code in a credential-free container, while a host process mediates the few operations that need SSH keys, API tokens, cloud credentials, or kubeconfig. Those capabilities can come from wrapped CLI commands or local stdio MCP servers.
Constrained CLI tools
Unknown operations default-deny. Rules match exact subcommand token sequences, then enforce allowed flags, denied flags, value constraints, and optional positional limits.
Filtered MCP servers
Wraptool can spawn local stdio MCP servers with host-side credentials and expose only named tools under a configured prefix. Deny wins; arguments pass through.
Explicit execution
Commands run as argument arrays through exec.CommandContext, never through a shell. Calls have timeouts, bounded CLI output, result scrubbing, and an audit event.
Human escalation
Denied calls can become capability requests. An operator reviews them through the CLI or local review UI; accepted changes hot-reload. The review UI is a separate, token-gated listener from the harness’s MCP connection — but under the Guix runtime’s shared host network namespace it is routable, not unreachable, from inside the container.
Primary workflow
# From a Git worktree, after installing wraptool and creating its config:wraptool up
up ensures the shared host server is running, chooses the Guix or Dev Container runtime, wires the selected harness to MCP, and opens a shell when attached to a terminal. Local compilation, tests, and ordinary Git can stay inside the box; privileged operations cross the policy boundary.
For credentialed APIs already packaged as MCP servers, Wraptool can proxy their allowed tools instead of forcing them through a CLI adapter. See MCP integration.
WarningA bounded capability system, not a sandbox for everything
The workspace retains its source tree and network access. It can read the MCP token and invoke every capability granted to the harness. CWD containment is only enforced when mcp.allowed_cwd_roots is configured, and output scrubbing is heuristic. Read Security model before exposing real credentials.