agent-tool is an MCP (Model Context Protocol) tool server for AI coding agents, distributed as a single binary, packaging about 40 tools together and exposing them to agents on demand through compact profiles. It mainly addresses the known limitations of built-in tools in indentation style, file encoding, tool count, reverse engineering support, and network access.
Purpose and Problems Solved Tools built into AI coding agents (such as Claude Code, Cursor, Codex, etc.) have several limitations: LLMs usually output spaces, while projects may use tab indentation, and the built-in Edit tool writes spaces as-is, breaking the indentation style; editing EUC-KR, Shift-JIS, or GB18030 files silently converts them to UTF-8, breaking legacy projects; having agents separately find, install, and configure tools such as Redis CLI, MySQL client, and SSH client is cumbersome and error-prone; built-in tools cannot disassemble binaries, inspect PE/ELF headers, find function boundaries, or search cross-references; in some countries, government-level network filtering breaks ordinary curl/wget requests. agent-tool solves these problems through agent-oriented tools, preserving project conventions while controlling the scale of the model context.
Main Capabilities Encoding-aware file tools: preserve the original file encoding when editing, with detection priority being BOM → .editorconfig charset → UTF-16 without BOM → valid UTF-8 → chardet auto-detection → fallback encoding; supports UTF-8, UTF-8 BOM, EUC-KR, Shift-JIS, ISO-8859-1, UTF-16 (LE/BE, with or without BOM), etc. It does not falsely report low-confidence warnings for pure ASCII files. For line endings, it can detect LF, CRLF, CR, and mixed files; when edit matches a multi-line old_string, it is compatible with CRLF or LF, and inserted text follows the newline style of the surrounding region. Smart indentation: automatically converts indentation to the file's existing style, reads indent_style and indent_size from .editorconfig, and falls back to content-based detection (first 100 lines); when the actual content contradicts .editorconfig, it does not convert, in order to protect legacy files. Token safetyDirectory listing: listdir defaults to 500 entries per page, returning next_cursor when exceeded; use directories_only, files_only, name_pattern (e.g. A*) or multiple OR patterns in include to narrow results; when counts_only=true, only the number of matching files/directories is returned. Idle memory release: after 30 minutes without tool calls, the server returns heap memory to the operating system; already-open shell and ssh sessions are unaffected, and client-observable behavior is unchanged. Reverse engineering support: includes static binary analysis (disassembly, decompilation to C using PDB/DWARF types, xref, function detection), a DAP debugger, and CheatEngine-style memory tools. Network access: by default uses ECH (Encrypted Client Hello) and DoH (DNS over HTTPS) to bypass network censorship. Remote and system tools: SSH/SFTP, MySQL, Redis, file operations, HTTP requests, process memory, etc.
Usage Download the binary for your operating system from Releases, run agent-tool install (or agent-tool install claude to specify an agent), and restart the IDE/agent. You can also have an AI agent automatically complete the download, installation, and restart process. After installation, you can instruct the agent to prefer agent-tool, for example by adding instructions in CLAUDE.md / AGENTS.md, or by disabling built-in file tools at the permission level via ~/.claude/settings.json to force its use.
Profile and context control The default core profile exposes only 11 schemas (including toolbox); protocol-level measurements show the serialized tool list dropping from about 74 KB (full) to 15 KB. For a minimal steady-state context, use --profile core-lite, whose 5 schemas are about 6.4 KB and expose only read, write, edit, grep, and toolbox. You can use toolbox(operation="describe", tool="ssh", compact=true, tool_operation="execute") to load only the fields of a single operation, then call it via toolbox(operation="call", tool="ssh", arguments={...}). The gateway does not rely on dynamic tool list refreshes, so it is suitable for fixed-binding clients such as Codex. Available profiles include core-lite, core, coding, remote, analysis, full.
Environment variables and connection configuration You can set AGENT_TOOL_FALLBACK_ENCODING and/or AGENT_TOOL_PROFILE to avoid repeating CLI flags; priority is CLI flags > environment variables > default (UTF-8). SSH and SFTP support connection_profile or session-level connection_id; the configuration file is located at agent-tool/connections.json in the operating system user configuration directory, and its location can be overridden with AGENT_TOOL_CONNECTION_PROFILE_FILE.
Security and limitations SSRF protection: cloud metadata IPs (169.254.x.x, fe80::/10) are always blocked; private IP access can be configured per protocol via set_config. DLP: all outbound HTTP request bodies are scanned for sensitive data patterns (PEM private keys, AWS access keys, GitHub/GitLab tokens, Slack tokens, .env file dumps) and blocked before transmission. Zip Slip and Zip Bomb protection are provided, symbolic links are skipped by default, and the default file size limit is 100MB. When using it, you should review the AI agent's tool calls, especially SSH commands, HTTP requests to external URLs, and database queries.
Applicable scenarios Suitable for legacy projects that need to preserve project indentation and encoding conventions, development tasks that require reverse engineering or binary analysis, scenarios that require remote system operations such as SSH/SFTP/databases, and agent workflows that need ECH/DoH in network-restricted environments.
Other information The project is based on the MCP SDK (github.com/modelcontextprotocol/go-sdk), uses saintfish/chardet and golang.org/x/text for encoding detection, and is distributed cross-platform as a single binary. Specific pricing, charging models, and platform support details are not yet provided.
