The Toolkits plugin provides a mechanism for creating named subsets of the tool catalog. Each toolkit acts as a specialized MCP (Model Context Protocol) endpoint with its own scoped policy rules and connection patterns. This allows administrators to expose specific capabilities to different agents or users while maintaining granular control over tool access and approval requirements.
A Toolkit is defined by:
org (Workspace) or a user (Personal) packages/plugins/toolkits/src/page.tsx47-51approve, require_approval, or block rules mapped to tool patterns packages/plugins/toolkits/src/server.ts34-43The plugin uses three primary storage collections defined via definePluginStorageCollection packages/plugins/toolkits/src/server.ts55-73:
toolkits: The root toolkit metadata.toolkitPolicies: Rules governing tool execution within the toolkit scope.toolkitConnections: Rules governing tool availability/visibility.The plugin is split into a server-side implementation that handles storage and policy resolution, and a React-based client for management.
When a tool is invoked through a toolkit, the system resolves the effective policy by checking connections first, then evaluating prioritized policy patterns.
toolkitConnections, it is automatically blocked packages/plugins/toolkits/src/server.ts160-165position string (using fractional-indexing) and id. The first matching pattern determines the action packages/plugins/toolkits/src/server.ts167-176approve or require_approval action packages/plugins/toolkits/src/server.ts177This diagram shows how a tool request is filtered through the Toolkit's rules.
Toolkits provide specialized MCP endpoints. Instead of the default /mcp path, toolkits are accessed via /mcp/toolkits/$toolkitSlug.
In host environments like Cloud or Self-host, the system must distinguish between global MCP requests and toolkit-specific ones.
classifyMcpPath: Parses the URL to identify if it is a toolkit route and extracts the toolkitSlug apps/cloud/src/mcp/mount.ts79-96prepareMcpOrgScope: Normalizes org-scoped paths (e.g., /acme/mcp/toolkits/deploy) by stripping the org prefix and moving it to the x-executor-mcp-organization header for downstream processing apps/cloud/src/mcp/mount.ts119-130Associates routing logic with the authentication and metadata entities.
The toolkit management interface is implemented in packages/plugins/toolkits/src/page.tsx. It provides a dashboard for creating and configuring toolkits.
ToolTree component allows users to browse available tools and toggle their inclusion/policy status within the toolkit packages/plugins/toolkits/src/page.tsx59-60createPluginAtomClient to sync toolkit state with the backend, leveraging reactivityKeys like connections and policies to trigger UI updates when rules change packages/plugins/toolkits/src/page.tsx70-85The plugin registers itself into the host application using defineClientPlugin, mounting the ToolkitsPage at both the root / and the slug-specific /$toolkitSlug paths packages/plugins/toolkits/src/client.tsx5-17
| Feature | Implementation |
|---|---|
| ID Generation | Uses newId with a prefix and timestamp-based entropy packages/plugins/toolkits/src/server.ts86-87 |
| Slugification | Converts names to lowercase, hyphen-separated strings (max 63 chars) packages/plugins/toolkits/src/server.ts91-97 |
| Indexing | Uses fractional-indexing via generateKeyBetween for manual policy reordering packages/plugins/toolkits/src/server.ts21 |
| E2E Testing | Verified via Playwright scenarios that create toolkits, add OpenAPI specs, and validate UI grid layouts e2e/selfhost/toolkits-ui.test.ts30-168 |
Sources: packages/plugins/toolkits/src/server.ts packages/plugins/toolkits/src/page.tsx apps/cloud/src/mcp/mount.ts apps/host-selfhost/src/mcp/auth.ts
Refresh this wiki