Most guardrails let the model call a dangerous tool and then say no. Here, leaving `containers:delete` off the key means `delete_container` never appears in the tool list, and the WAGMIOS API would reject it even if it did. That plus the per-key audit trail is the whole reason to add a hop between your agent and the Docker daemon.
A Go MCP server that sits between an AI client and WAGMIOS, a self-hosted Docker management platform. It reads the scopes on your API key at startup and registers only the tools that key permits, so an agent cannot call what it was not granted — the enforcement lives in the key, not in the prompt.
- Always available: `check_scopes` shows the key's label, prefix and granted scopes
- Read tools behind `containers:read` and `system:read` — `list_containers`, `container_logs`, `container_config`, `system_info`, `system_metrics`
- Lifecycle behind `containers:write` — `start_container`, `stop_container`, `restart_container`, `create_container`
- Deletion behind its own `containers:delete` scope — `delete_container`
- Images — `list_images` on read, `pull_image` and `delete_image` on write
- A self-hosted app marketplace — `browse_marketplace`, `get_marketplace_app`, `list_installed_apps`, then `install_app` and `start_app` on write
- Multi-machine mode: one server, several WAGMIOS instances, a `host` parameter on every tool and a `list_hosts` tool, each host keeping its own scopes
A running WAGMIOS instance — the documented setup brings it up with Docker Compose, serving its API on port 5179 and its UI on 5174 — and a scoped API key created in its Agent Permissions screen. Install the server with `go install`, or run the published Docker image. Pass the URL and key as launch flags or as WAGMIOS_API_URL and WAGMIOS_API_KEY. stdio for local clients; SSE if you need to reach it remotely. MIT licensed.
One command plus a key — go install github.com/mentholmike/clawmachine/cmd/clawmachine@latest, then supply credentials