Tokening joins the studio as a small self-hosted permission gateway. An operator issues a grant for one task, such as editing a particular WordPress post once before a deadline. The agent holds only that grant secret. The real API credential stays in the gateway, and the admin listener must stay outside the agent’s reach. Every call is checked and recorded with a readable reason.
The first release supports MCP over HTTP and REST forwarding in one Go binary with SQLite storage. Consumption commits before forwarding, so an upstream failure still spends the use. All five native targets passed the full test suite and extracted-archive smoke checks; each recorded exactly one winner in every one of 1,000 single-use races. The recorded Docker WordPress replay shows an allowed edit, refused repeat, wrong post and delete attempts, and a parallel race. It uses no public WordPress site.
The project website includes downloads, a local quick start, the permission model and measured release evidence. The code is Apache 2.0. Stdio MCP, grant approval requests and a hosted service are outside v0.1. The recorded independent project review is not an external security audit.