Skip to content
Get started
Hosted MCP server

One MCP serverfor every app.

Your agent gets two tools, search_tools and execute_tool, instead of hundreds of tool definitions. It finds the right action for the job, then runs it.

Get started freeRead the docs

Free for up to 3 apps. Unlimited calls. No card needed.

Toolrails · single journey

From
your prompt
To
any of 214 apps
Via
search_tools ⇒ execute_tool
  1. search_tools"create a linear issue"38msok
  2. execute_toollinear.create_issue318msok

Fare

910tokensinstead of 94,200

two tools · vs 20 servers, every schema

Admit one agent

Set up in about a minute

Why Toolrails

What you get with Toolrails.

  • Spend far fewer tokens

    Your agent loads two small tools instead of hundreds of tool definitions, so more of its context is left for your task.

    910 tokens instead of 94,200

  • Get the right tool first time

    Search understands what your agent means, not just the words it uses. Ask for "tickets" and it finds issues, plus anything that has to run first.

    Right tool in the top 5, 95% of the time

  • Stay safe from hidden instructions

    Emails and tickets can carry text that tries to take over your agent. Toolrails flags it, and asks you before anything risky runs.

    See the injection benchmark

  • Set up in a minute

    Paste one URL into Claude, Cursor, VS Code or Windsurf. No SDK to install and no setup for each app.

    About 60 seconds, start to finish

  • Reach almost any app

    GitHub, Slack, Stripe, Notion and hundreds more, each through its real API. Nothing you send is stored.

    214 apps and counting

  • Free to start, never cut off

    Connect up to 3 apps and make as many calls as you like. No card, and no surprise limits mid-task.

    Free for 3 apps, then from $12 a month
How it works

Search first. Then run.

  1. Step 1 · search

    The agent asks for what it needs

    search_tools takes plain words and returns a few matching actions with short schemas. Anything that has to run first comes back by name.

    { "query": "list open tickets", "limit": 3 }

  2. Step 2 · run

    Then runs the one it picked

    execute_tool calls the real app with its own schema. Ask for specific fields and only those come back. Big results arrive as a short-lived link.

    { "name": "linear.list_issues",
  "args": { "state": "open" },
  "fields": ["id", "title"] }

  3. If an app isn't connected

    You get a link, not an error

    If the agent needs an app you haven't connected, it gets a link to share with you. Approve once and it tries again.

    { "isError": true,
  "connect_url": "toolrails.com/connect/tk_9f…" }
Optional · Code Mode

Chaining several calls? Turn on run_code for a toolset. The agent writes one script, it runs in a sandbox, and only the final output comes back.

Example

One request, start to finish.

The agent searches in plain words, gets one good match with its schema, runs it, and replies. Two small calls.

You: File a bug in Linear: checkout fails on Safari.

search_tools"create a linear issue"ok38ms201 tok
Input
{
  "query": "create a linear issue"
}
Output
[
  {
    "name": "linear.create_issue",
    "score": 0.96,
    "needs_first": [
      "linear.list_teams"
    ]
  }
]
execute_toollinear.create_issueok318ms64 tok
Input
{
  "name": "linear.create_issue",
  "args": {
    "team": "WEB",
    "title": "Checkout fails on Safari"
  },
  "fields": [
    "id",
    "url"
  ]
}
Output
{
  "id": "WEB-212",
  "url": "https://linear.app/acme/issue/WEB-212"
}

Agent: Filed WEB-212 in Linear.

Safety

Safe around untrusted content.

Emails, tickets and notes can hide instructions aimed at your agent. Your rules decide what the agent can do at all. Detection adds a second layer inside those rules.

See the injection benchmark

  • Rules

    Decide what the agent can do at all.

    Allow or block apps and actions, make a toolset read-only, and hide fields before the agent sees them.

    hris.get_employee   hide: salary, ssn
xero.update_payee   only approved vendors

  • Approvals

    Risky actions wait for your yes.

    Once the agent has read an outside email, ticket or note, actions like sending mail or changing bank details need your approval in the chat.

    read gmail.get_message  → outside content
gmail.send_email       → asks you first

  • Detection

    Hidden instructions get flagged.

    Every result from an outside source is checked, including attacks split across several messages.

    mode: thorough
if flagged: warn · remove text · block · ask you
Setup

Set up in about a minute.

Paste one URL into your client. It asks you to sign in, you pick which apps it can use, and the two tools appear.

Claude Desktop · Settings → Connectors → Add custom connector
https://mcp.toolrails.com/t/default

Paste the URL, name it Toolrails, then sign in when asked.

Integrations

Works with the apps you use.

214 apps · 4,213 actions

Browse integrations
Pricing

Priced for side projects.

Compare plans

Free · single

Free

For side projects and trying it out.

no card needed

$0 /month

Up to 3 connected apps

  • Unlimited calls
  • Pick from every integration
  • 1 toolset
  • App and action rules
  • 7 days of call logs
Start free

Indie · returnMost picked

Indie

For projects people rely on.

billed monthly

$12 /month

Unlimited connected apps

  • Everything in Free
  • Unlimited toolsets
  • Field rules
  • Code Mode
  • Thorough injection checks
  • 30 days of call logs
Choose Indie

Team · group

Team

For a team sharing one workspace.

flat, any team size

$49 /month

Unlimited apps and $0 seats

  • Everything in Indie
  • Add seats at $0 each
  • Owner, admin and member roles
  • Audit log export
  • 90 days of call logs
  • Email support
Choose Team

Try it with your own agent. Free for up to 3 apps, with unlimited calls.

Get started free