Flowlight 0.3.6

What's new in 0.3.6

Agent guardrails: block an MCP server, a tool or a resource.

Which tools may this agent use is a different question from which hosts may it reach, so it gets its own place: a Guardrails tab beside each agent in AI Agents, with a switch on every tool the agent declares and every MCP server it reaches, presets worth having — read-only, no shell, no writes — and a record of what has been taken away.

• The declaration is the strongest lever. Agents re-send their whole tool list on every turn. Flowlight removes a refused tool from that list before the request leaves, so the model is never offered it: no refusal to argue with, no retry loop. It works the same for a tool the agent runs itself and one behind a remote server, and it reads the shapes Flowlight already parses for Anthropic, OpenAI and Gemini.
• A refused call is answered properly. For MCP servers reached over HTTP, a blocked tools/call comes back as a result with isError: true and a plain sentence — the protocol's own shape for a tool that failed, so the model reads it and works around it rather than seeing a broken server. resources/read and prompts/get get a JSON-RPC error, which is theirs.
• Connectors are narrowed, not intercepted. When the provider reaches a server on the agent's behalf, that traffic never touches this Mac; the only lever is the request that sets it up, so Flowlight narrows the tools it may call or drops it entirely.
• Local stdio servers speak over pipes, and no proxy can see that. Flowlight watches the server process's own network traffic — already attributed to the agent that started it — and hands you the deny list to paste into the agent's own settings.
• It is not a sandbox, and says so. A refused tool stops being offered and stops being answered; an agent that still has a shell can do by hand what the tool would have done. Flowlight records that rather than pretending to prevent it.

Guardrails need HTTPS inspection, because the tool list lives inside a request body. With inspection off the tab says so rather than looking as though it is working.

Install

Signed with Developer ID and notarized by Apple.

• brew install --cask xinbetween/tap/flowlight
• Flowlight.dmg — drag to Applications.
• Flowlight-0.3.6.pkg — installs to /Applications; offers to quit a running copy first.

macOS 15 or later, Apple silicon and Intel.

Checksums

dfce6e2c92b393f09c99c4ecaa0b49050ec11329c97bf9d89b6cbce48a8a7c84  Flowlight.dmg
fda9128e9d73c63818fd44a1b6d8bb89b8f6de027421b4a89fb19d08f5ff344e  Flowlight-0.3.6.pkg