Security and data handling

Toolstile checks which remote MCP connections an agent may use and which tools, resources and prompts it may access. Stored MCP credentials and optional debug captures are encrypted. Toolstile processes requests and responses to forward them, so the service can read traffic in transit through the gateway. Your connected providers retain their own access rules and data policies.

Account sign-in and agent authorization

Signing in to your Toolstile account and authorizing an agent are separate steps. Each agent authorization belongs to one workspace. Personal and team workspaces have separate catalogs; access to one does not merge them.

Agents usually authorize through browser sign-in. For scripts and clients that accept a bearer token, you can create an agent token instead, with an expiry you choose. Treat it as a credential: anyone who holds it can use that agent's permitted access. A new agent, however it authorizes, starts with no access to the workspace's MCP connections.

Toolstile checks current workspace membership, agent authorization and capability permissions when discovering and forwarding requests. An explicit block wins over an allow, including full access or an assigned policy. Filtering the agent's catalog is one part of this enforcement; execution is checked too.

For example, a coding agent allowed to search an issue tracker can be blocked from its delete tool. A broader policy allowing the same connection does not override that block. See permissions and revocation.

Credentials and upstream accounts

MCP credentials you supply, such as a bearer token, and upstream OAuth tokens are encrypted before storage. Optional captured request arguments and results are also encrypted. Passwords and recovery codes are stored as one-way hashes. If you sign in with Google, the Google access token stored with your sign-in record is encrypted too; the privacy policy describes what Google sign-in shares.

Toolstile decrypts usable MCP credentials to authenticate with the connected server and refresh its authorization when needed. Requests and the credentials needed to authorize them go to that server. Choose upstream accounts with permissions appropriate to the work your agents perform.

Sharing an approved account lets authorized team agents use it without the dashboard displaying its stored credential to those members. A connected tool or service can still return sensitive information in its output. Review the provider's permissions and account-sharing terms before sharing access.

The account selected for an MCP entry also matters. Your preferred account takes precedence over the workspace default. If that selected account becomes unavailable, Toolstile stops using the entry until an available account is selected. Other available entries can continue. The shared accounts guide explains approvals and account selection.

Remote connection boundaries

Toolstile connects to public HTTPS MCP servers on port 443. It rejects private-network and localhost destinations and does not run local MCP processes. The check applies to the resolved network address and is repeated when the gateway connects. Upstream HTTP redirects are rejected rather than followed.

Your connection to toolstile.com uses HTTPS. The gateway then makes a separate HTTPS connection to the remote server. Toolstile handles the request and response between those connections, including temporary data needed for delivery and resumable sessions.

A gateway permission cannot grant rights that the upstream account lacks. It also cannot control calls made directly to a provider outside Toolstile. Use the connection guide to check the server address and authentication requirements before granting agent access.

Activity and debug capture

Activity logs record operation metadata by default: the agent and MCP entry, method and target, outcome, duration, user and time. They do not store request arguments or results. Error messages and diagnostic logs can still contain information returned by a connected service.

Debug capture is optional and off by default. Select the agents and MCP connections whose arguments and results you need to inspect. A capture session stops after one hour unless explicitly extended, and you can stop it sooner.

Captured content is size-limited, automatically redacted for credential-like fields and values, and encrypted before storage. Redaction may not catch every secret, and captures may be truncated. Keep capture limited to traffic you need to investigate. For a failed issue search, capture the affected agent and issue-tracker connection rather than unrelated workspace traffic.

In your personal workspace, only you can start or view captures. In team workspaces, capture is limited to owners and admins. A custom role's permission to view activity metadata does not grant capture access.

Retention and deletion

Debug capture contents expire after up to 24 hours. Activity metadata and records of capture sessions are retained for 30 days. Expired capture contents cannot be opened; automatic maintenance removes expired records.

These periods do not cover every service record. Billing and usage records, security and administrative records, and support messages have separate retention purposes. Account or workspace deletion stops access immediately and allows a seven-day recovery period, with data removal and exceptions explained in the privacy policy.

Infrastructure and security limits

The primary application and database run on Railway in Amsterdam, Netherlands. Cloudflare provides DNS and the www redirect. Providers may process information in other countries; the privacy policy lists providers and their roles.

Toolstile does not sell personal data, and does not use your content, MCP traffic or captures to train AI models.

Use Toolstile's permissions alongside the controls in your agent and connected services. An allowed tool can still perform a harmful action, and an upstream response can contain misleading instructions or sensitive data. Revocation blocks further authorized use through Toolstile; it cannot undo an action an upstream service has already performed.

Clients may need to reconnect after maintenance or a restart. Availability terms are set out in the terms of service.

Report a vulnerability

Follow the Toolstile security reporting policy to report vulnerabilities privately through GitHub. Include the affected feature, reproduction steps and potential impact. Keep real credentials and customer data out of the report, and keep vulnerability details out of public issues.

For account or privacy requests, contact support@toolstile.com.

Read the permissions guide to choose what each agent can use.