MCP server · 1.8.0

Your agents.
One shared fleet.

ToolsEnabled Fleet is an MCP server your agent starts over stdio. It adds a shared task list and ledger, memory, coordinated file edits and an optional tree of workers to the agents you already use.

Choose how to run it Download source

Free · Open source · MITLinux x86_64 · WSL 2Your agents · Your accounts

One work record

Keep the work moving.

Tasks and a ledger

Agents claim, checkpoint and finish durable tasks. The shared ledger keeps tasks, standing rules and questions together across sessions.

Memory and search

Keep notes and search indexed files across sessions and agents. Local lexical search needs no model.

Coordinated file edits

Fleet mediates reads, writes and patches against the actual file bytes. It refuses stale overlapping edits and merges changes that do not overlap.

An optional worker tree

Let workers delegate, send reports, stop and resume, within your limits on depth, width, roles and agent choices. Workers are off until you enable them.

You control Fleet from the terminal: toolsenabled ledger, toolsenabled tree, toolsenabled settings and toolsenabled status.

Bring what you use

Any agent, any model.

Start your own lead agent and connect Fleet as a stdio MCP server. Workers can use installed agent CLIs, your own API model connections, or local model servers you already run.

Agent CLIs: Bundled descriptors cover Claude Code, Codex, Gemini CLI and OpenCode. Any of them can be your lead. Codex, Gemini CLI and OpenCode can also be workers, subject to their enforceable permission levels; Claude Code workers are not part of 1.8.0. You can add a descriptor for another CLI; worker support also needs a compatible protocol driver.
API models: Direct model workers support OpenAI Chat Completions, OpenAI Responses and Anthropic Messages formats, with your own keys and billing.
Local models: Connect an existing Ollama, LM Studio, vLLM, llama.cpp or SGLang server. Fleet does not install or start a model server. The exact endpoint and model must support structured tool calls; format support alone is not model qualification.

toolsenabled agents shows what Fleet found. It uses each CLI's own status command when available and labels unknown sign-in states. Local discovery asks loopback model servers which models they serve.

Gemini CLI needs your own Gemini API key, Vertex AI, or a Gemini Code Assist Standard or Enterprise sign-in. Google ended Login with Google for individual plans in Gemini CLI on 2026-06-18. Gemini CLI also turns MCP servers off in folders you have not trusted; trust your working folder once in Gemini.

Codex and Gemini CLI do not pass your API keys or tokens to MCP servers unless you allow them. Fleet asks them to pass only the agents' profile folders, so workers use the same profiles as your lead. To let workers use a key from your environment, run setup with --pass-env NAME[,NAME...]. Fleet records the names only; the agent passes the values when it runs.

OpenCode workers need a lead started with its no-prompts setting (level 4), and a role that keeps that level. A headless worker cannot show approval prompts; Fleet refuses to start one if its CLI cannot enforce the inherited limits.

For another MCP client, toolsenabled setup --print-server-json prints the server entry. Fleet installs only Fleet. Install and sign in to agent CLIs through their own instructions, where Fleet will run.

Your choices carry down

Inherited, never widened.

You start your lead however you like. Fleet reads its command line to find the permission level. Every worker inherits that level, reduced by its role and every ancestor. Roles only take permissions away.

Read only
Reads, without edits.
Asks
The agent's normal approval mode. A worker declines anything that would prompt.
Edits on its own
Edits within the agent's inherited limits without asking for each edit.
Everything
The lead's no-prompts level, still subject to role limits and any outer sandbox.

If Fleet cannot read the lead's level, it uses level 2. If a worker cannot enforce its inherited level or tool removals, Fleet refuses to start it. Each worker's own sub-agent feature is switched off so delegation stays within Fleet's tree and limits.

Fleet sets no permission of its own, adds no permission grants to agent settings, and blocks nothing you chose for your lead. Its file tools still respect their workspace boundary and protected paths. Host mode supplies no sandbox; in sandbox mode, OpenShell supplies the confinement.

Install 1.8.0

Two ways to run it.

Use Fleet directly on your machine or inside an existing sandbox. Both use the same engine and stdio MCP connection. The installers run offline; install prerequisites separately.

Verify before extracting or running anything. These are the SHA-256 digests of the 1.8.0 files, also listed in SHA256SUMS. A checksum downloaded beside an archive detects corruption; compare it with the digest on this page before you continue, and stop if they differ.

aa74592bd22ec1bd0b64fb619ece16f2f0e6512809339b9f4b13d8e0776dcd84  toolsenabled-host-1.8.0-linux-x64.tar.gz
9ea7a5875b1911fc87b2ec72be853822fb753f7065a0739155a7c2fef15b570c  toolsenabled-openshell-1.8.0-linux-x64.tar.gz
2c9da92c7e8d1484bb9f2cd23cc6c7898d3839805ba8964ac22ff057d342e420  toolsenabled-fleet-1.8.0-source.tar.gz

On your host Inside a sandbox Uninstall

01 · Host mode

On your own machine.

Linux x86_64 or the Linux filesystem in WSL 2. You need Node.js 22.19.0+, Python 3.11+ and your separately installed agent CLIs. Native Windows and macOS are not supported by this installer.

Host mode runs as your operating-system user, with your network and permissions. It provides no sandbox, network confinement or CLI credential custody.

Close agent sessions and configuration editors before setup or uninstall, and keep them closed until completion or recovery. Download the host archive above and set its absolute path below. Run verification first; continue only if it succeeds.

# Set archive to the absolute path where you saved the download.
archive=/absolute/path/toolsenabled-host-1.8.0-linux-x64.tar.gz
release_sha256=aa74592bd22ec1bd0b64fb619ece16f2f0e6512809339b9f4b13d8e0776dcd84
printf '%s  %s\n' "$release_sha256" "$archive" | sha256sum -c -
umask 077
stage=$(mktemp -d)
tar -xzf "$archive" -C "$stage"
bash "$stage/toolsenabled-installer/install.sh" --host \
  --archive "$archive" --sha256 "$release_sha256"

The default workspace is ~/work. Append --workspace ABS to the install command to select a project inside your account home, or your account home itself for a global workspace. Hidden top-level home entries, including dotfiles and dot folders, are never part of a workspace. Symbolic-link aliases are refused. For a global workspace, workers start in the lead's working folder, and the archive must sit outside the workspace: keep it outside your home folder or in a hidden folder such as ~/.cache.

Workers are experimental and off by default. To enable them, append --enable-workers at installation. They require Linux 5.3+, usable pidfd_open, process observation/signalling, subreaper support and a passing containment check. Fleet refuses if these are unavailable.

Installation creates a separate runtime and state and registers the Fleet MCP entry with installed described CLIs. Restart your agent sessions afterwards. The command is ~/.local/toolsenabled-host/toolsenabled-installer/toolsenabled; invoke it by its full path because setup does not add it to PATH. Use it for the status and agents commands shown on this page.

02 · Sandbox mode

Inside your sandbox.

Install into an existing Linux x86_64 NVIDIA OpenShell sandbox. OpenShell provides filesystem and network confinement, access approvals and custody of the credentials it manages. Fleet does not install OpenShell or change its policy.

Install Node.js 22.19.0+, Python 3.9+ at /usr/bin/python3, and the agent CLIs you use in the sandbox image first. The documented compatibility baseline is OpenShell 0.1.2 with rootful Docker on Linux x86_64. The WSL 2 route with Docker Desktop's Linux engine is experimental; this is not a claim of qualification for every version or platform.

On the host, put SHA256SUMS and all archives it lists in the same directory, and check that its digests match the ones above. Continue to upload only after verification succeeds; replace YOUR_SANDBOX with your sandbox's name.

sha256sum -c SHA256SUMS
openshell sandbox upload --no-git-ignore YOUR_SANDBOX toolsenabled-openshell-1.8.0-linux-x64.tar.gz /sandbox/

Then, inside that sandbox:

cd /sandbox
umask 077
tar -xzf toolsenabled-openshell-1.8.0-linux-x64.tar.gz
bash toolsenabled-installer/install.sh --setup \
  --archive /sandbox/toolsenabled-openshell-1.8.0-linux-x64.tar.gz \
  --sha256 9ea7a5875b1911fc87b2ec72be853822fb753f7065a0739155a7c2fef15b570c
source ~/.local/toolsenabled/env.sh
toolsenabled status

The installer runs setup for you: it registers Fleet with each installed described CLI, with workers on and every described worker agent allowed. Sign in through each CLI's own flow, then start a new agent session. To change those choices later, run setup again, for example toolsenabled setup --agents --providers AGENT[,AGENT...] --add with ids from toolsenabled agents, or toolsenabled setup --add for no workers. Setup replaces only the entries its own record shows it wrote. In a new shell, source the installed prefix's env.sh again.

The optional toolsenabled-authority service keeps settings, ledger and signed audit outside the sandbox on the machine running OpenShell. Its listener is loopback only, with separate per-agent grants held by OpenShell providers. You configure those providers and policy yourself. The source archive includes the setup guide at adapters/openshell/HOST-OUTSIDE.md.

Without that separate authority, Fleet's record and optional signed audit run as the same sandbox user as the agents. They are not tamper-proof against those agents. The outside authority does not control sandbox file access or anchor the sandbox's audit.

Remove Fleet. Keep your state.

Host mode: close agent sessions and configuration writers. Keep the original approved archive and digest. Verify and extract that same archive into a fresh private stage outside the installed runtime, using the verification and extraction lines above, then run:

bash "$stage/toolsenabled-installer/install.sh" --uninstall \
  --archive "$archive" --sha256 "$release_sha256"

Repeat the original --prefix, --state-root and --workspace arguments if customized. Removal verifies the matching Fleet entries and pinned runtime; shared state remains.

Sandbox mode: stop agent sessions and Fleet tree hosts using the installation. Inside the sandbox, with the original archive still at /sandbox:

toolsenabled uninstall --keep-state \
  --archive /sandbox/toolsenabled-openshell-1.8.0-linux-x64.tar.gz \
  --sha256 9ea7a5875b1911fc87b2ec72be853822fb753f7065a0739155a7c2fef15b570c

Uninstall retains state. Changed files, unknown contents or registrations whose ownership cannot be proven can stop removal. Preserve reported recovery material for review. The source archive includes the full lifecycle guides at docs/HOST-MODE.md and installer/openshell/README.md.

How 1.8.0 was checked

Tested before release.

Automated tests: All 442 automated test files pass for the release source: the MCP server, inherited permission levels for every lead level, worker and role, registration, both installers, credential redaction and the agent tree.
Real agent CLIs: Hand tests drive the real, unmodified Claude Code 2.1.289, Codex 0.160.0, Gemini CLI 0.58.0 and OpenCode 1.18.34 against a local model simulator, two runs each from a frozen copy of the release source. Inside an OpenShell 0.1.2 sandbox both runs passed all 104 applicable checks. On a Linux host the first run passed all 90 applicable checks and the second 89: its audit-off check read the audit while a busy session was still writing, and the audit verified valid moments later. In each mode six combinations are unsupported by design: OpenCode as a lead at permission levels its CLI has no setting for.
Exact archives: The published sandbox archive was installed in a fresh OpenShell 0.1.2 sandbox, set up again with --pass-env, and uninstalled. The host archive was installed and uninstalled against separate agent profiles. Both used the commands on this page.
Not yet measured: These checks use a local model simulator in place of model providers and no real sign-ins, so they say nothing about how well a given model does the work. Windows (WSL 2) and OpenShell versions other than 0.1.2 were not part of this round.

The details, plainly

What runs. What leaves.

No Fleet login

Fleet never signs in, reads, copies, stores or forwards an agent's sign-in, OAuth token, session token or credential file. It never switches accounts. Agent CLIs keep their own environment and sign-in variables. Discovery uses status commands and can check whether a key name is set without reading its value. Direct model requests use only the API key you explicitly configure for that connection.

Where Fleet writes

State lives in ~/.toolsenabled-host on the host, ~/.toolsenabled in OpenShell, or the folder you choose with --state-root / TOOLSENABLED_STATE_ROOT. It contains the work record, memory, settings, tree records and optional signed audit.

Installation or an explicit setup --add registers Fleet in the agent's MCP list. Fleet uses the documented registration command or edits its own entry, preserving unrelated settings. Project files change only through tools called by your agent or workers, within inherited limits.

Nothing sent to ToolsEnabled

Fleet has no telemetry and no update check. Its own network use is limited to configured model endpoints, loopback model discovery and OpenShell's policy service when you use its policy tools. Agents contact their own providers under your accounts and terms. Fleet does not pay for, resell or route that usage.

Sandbox telemetry is separate

OpenShell has its own default-on telemetry. NVIDIA describes anonymous operational categories and counts, excluding prompts, credentials, paths, model names and content. Set OPENSHELL_TELEMETRY_ENABLED=false in the gateway's environment to turn it off. For a local user-service gateway, the engine guide gives ~/.config/openshell/gateway.env as an example; restart the gateway when nothing is running. See NVIDIA's telemetry documentation.

Sign-ins and usage

A worker tree can consume a lot of a subscription plan. Anthropic says Pro and Max limits assume ordinary, individual usage of Claude Code and the Agent SDK. See Anthropic's legal and compliance documentation.

OpenAI recommends API key authentication for programmatic Codex CLI workflows. See OpenAI's authentication documentation. For unattended or heavy work, configure your agents with your own API keys through their own flows, billed to you.

Your agents.One shared fleet.