Why we built Toolspoke
Toolspoke is the layer between an AI agent and the systems a team actually runs on. One endpoint, access decided per project and per agent, and a record of every call.
It is built by the team at Onvo, and it came out of a problem we had ourselves: we wanted our own agents connected to our own tools, and we were not willing to hand them the credentials that would have made it easy.
What goes wrong with a shared key
The fastest way to make an agent useful is to give it a key that can do everything. It works on the first afternoon and it is a problem by the second week, for three reasons.
The credential is the blast radius
An agent given a personal access token can do everything that token can do. Nobody meant to grant a summarising agent the ability to close issues and rewrite branches, but one key does both.
Nobody can say what happened
When an agent touches a production system and something is wrong afterwards, the question is what it sent and what came back. Provider logs answer part of it, at best, and never in one place.
Access is all or nothing
A tool is usually connected once for the whole workspace. The contractor and the staff engineer end up reaching the same systems, because there is no layer in between that could hold them apart.
What a call goes through
An agent gets one MCP URL. Behind it, four things happen to every call, in this order.
The recording step is the one worth understanding before you adopt this. It captures the full request and the full response, which is what makes the log useful and also what makes it sensitive. The privacy policy describes it exactly.
Resolve
The call arrives with an agent key. Toolspoke resolves which member that key belongs to, so the rest of the pipeline is about a person rather than a token.
Apply
The project decides which of an installed toolkit's actions are reachable at all, and the key's own grant can narrow that further. Neither reaches past what the member can reach at that moment, so an agent cannot outlast its owner's access.
Execute
The credential is decrypted in memory, the call runs either in process or in an isolated sandbox, and the credential is not handed to the agent at any point.
Record
The request payload, the response payload, the member, the agent key, the timing and the outcome are written to the organisation's log.
Who builds it
Toolspoke is made by Onvo. We build software for teams that have to be careful with data, which is most of the reason this product looks the way it does.
What Toolspoke provides
Toolspoke can be self-hosted, so a team that cannot send its tool traffic to somebody else's servers does not have to. Credentials are encrypted at rest. A project decides what its tools may do, and an agent never reaches past its owner. Every call is logged. All of that is described in detail on the security page.
What it does not have yet
Toolspoke is not open source and holds no security certification. We would rather say that plainly than let a badge imply otherwise. When either changes, it will be on the security page with a date on it.
Try it with one tool
It is the fastest way to understand what this is. Install a connector, point an agent at the endpoint, make a call, and read what was recorded.
Last updated 27 August 2026