HN Showcase
Back to browse
GitHub Repository

Resource-level permissions for MCP agents: rwxd on any resource, deny by default

3 starsTypeScript

Wombat, a Unix-style rwxd permissions for MCP tool calls

by johnchque·Mar 17, 2026·2 points·1 comment
Visit ProjectView on HN

AI Analysis

●●●BangerBig BrainWizardry

Unix chmod for AI agents—same push_files tool allowed on feature branches, denied on main.

Strengths
  • •Resource-level permissions beat tool-name pattern matching for actual security
  • •Most-specific-rule-wins logic mirrors decades of proven Unix permission models
  • •Live dashboard showing allowed/denied calls in real-time provides immediate visibility
Weaknesses
  • •Only works with MCP-enabled agents, not general AI security
  • •Requires Node.js 22+ which may limit some enterprise environments
Category
Security
Target Audience

Developers using Claude Code or other MCP-enabled AI agents

Similar To

Aegis · MCP Gateway · LLM firewall tools

Post Description

I have been using Linux since 2012. When I started seeing agents deleting production databases and pushing to main, I was like, why don't we have chmod on this? We are supposed to be able to get a proper permission system for every action an agent makes.

Every file on a Unix system has rwx permissions. Every process has a user. We have that for decades. Agents in 2026 are running with the same access level as the developer who run them.

Wombat applies the Unix model to MCP tool calls. You declare rwxd permissions on resources in a manifest. The same push_files tool is allowed on feature branches and denied on main. It is a proxy that sits between Claude Code and your MCP servers. It checks permissions.json on every call, and either forwards or denies.

Zero ML, fully deterministic, audit log included, Plugin system for community MCP servers

GitHub: https://github.com/usewombat/gateway npm: npx @usewombat/gateway --help

Similar Projects

Developer Tools●●Solid

Unix-style pipeline composition for MCP tool calls

The project implements a sandboxed, server-side 'shell' that pipes MCP tool calls together so agents return only final outputs — a smart way to save tokens and handle datasets too large for LLM context. The repo includes a demo video, tests, and a real shell_engine/mcp_client implementation, but it's a focused infra play for the MCP ecosystem and will matter most to teams building agent platforms rather than general devs.

Niche GemBig BrainShip It
kantord
303mo ago