Documentation
¶
Overview ¶
wardyn-toolgate is the in-sandbox relay that turns Claude Code's tool-use permission prompts into Wardyn approvals. It is a minimal stdio MCP server exposing exactly one tool ("approve"); `claude -p --permission-prompt-tool mcp__gate__approve` calls it before every tool action the harness would otherwise have prompted a human for, and blocks until it answers.
On each call it raises a `tool_call` approval through the egress proxy's brokered route (POST /wardyn/v1/approvals — tokenless from the sandbox; the proxy injects the run identity), then polls the approval until an operator decides in the Wardyn UI. APPROVED returns {"behavior":"allow"}; DENIED and EXPIRED return {"behavior":"deny"} — fail-closed, matching the approval FSM's own posture.
The request/response contract with claude was pinned live against 2.1.234 (C0 spike): the tool receives {"tool_name": ..., "input": {...}, "tool_use_id": ...} and must answer with a JSON-stringified PermissionResult in the tool result's text content. Two caveats carried from the same spike: the harness auto-approves its read-only-safe command class (echo and friends) without consulting any gate, and the agent must run with CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT=0 so a multi-hour human decision cannot trip the stdio idle timer (agent-run sets it).
Source Files