Six focused MCP servers in one binary — filesystem access, bounded HTTP fetches, persistent memory, local process execution, reusable skills, and provider-backed local subagents. Designed around explicit capabilities, least privilege, and bounded I/O.
One binary, six focused MCP servers. Each one exposes only the capability you grant it.
Read, inspect, search, edit, and move workspace files inside explicitly allowed roots.
tuls filesystem /path/to/project --allow filesystem.readBounded HTTP(S) fetches with robots.txt and public-network policy, no redirects by default.
tuls fetch --allow network.fetchA persistent JSONL knowledge graph with entities, relations, and observations.
tuls memory --memory-file memory.jsonl --allow memory.read --allow memory.writeExecute one program directly with an argv array — no shell parsing, bounded output.
tuls shell /path/to/project --allow process.executeDiscover and activate workspace skills with their instructions and resource manifests.
tuls skills /path/to/project --allow skills.readRun local provider-backed subagents with their own child MCP tool policies.
tuls agents /path/to/project --allow agents.runtuls is intentionally small and opinionated. These rules shape every server.
Tools are grouped by stable capabilities
A client can grant filesystem.read without granting writes, or network.fetch without shell execution.
A denied tool is not merely hidden
Disabled routes are removed from discovery and rejected again at call time.
Subagents are default-deny for child MCP tools
Declaring a child MCP server does not automatically grant its tools to the model.
Unknown public parameters fail closed
MCP tool inputs reject unknown JSON fields; canonical agent definitions reject unknown fields.
Secrets stay outside agent files
Provider credentials are read from environment variables; literal provider secret fields are rejected.
Network and file operations are bounded
Large bodies, media, tool results, process output, and provider responses all have explicit limits.
MCP annotations are descriptive, not authorization
Child tool annotations never determine whether a subagent may call a tool.
The shell server is not presented as a sandbox
OS-level containment is a separate deployment responsibility.