Tokening 0.2.0 reaches the MCP servers most people actually run: the ones a client starts as a command, such as the filesystem, GitHub and database servers. A target can now be a command. For each tool call a grant allows, the gateway starts the server, sends the one call and stops it again with everything it started; a refused call starts nothing. The server gets PATH, HOME and a few system variables plus its own stored credential, never the vault key or the admin token. A new tokening connect command lets Claude Desktop, which only launches commands, go through the gateway with nothing but a grant.
The release post runs the released binary in front of the real filesystem server with a grant for one file. Reading it took 189 ms, server start included. The other file, a path with .., an extra argument, listing the folder and writing were all refused with readable reasons, and the server started once in the whole session. A one-write grant wrote once and refused the second try. The flight log verified intact.
An independent review found a hang when a server stops reading, no cap on servers per grant, and Windows leaving node running under npx; all fixed before release, and the tests now run on Windows in CI too. Open source under Apache 2.0, with releases for Linux, macOS and Windows.