- Ruby 100%
Peter Tillemans
6b5483d9e8
Homebrew does not trust a third-party tap by default. The failure mode is quiet: brew update skips an untrusted tap with a warning rather than an error, so upgrades never arrive and nothing looks broken. Trusting the formula alone does not cover it; the tap has to be trusted. Also states plainly what the trust buys: brew install runs the Ruby in this repository as your user, reviewed by nobody at Homebrew. The formula is four URLs, four checksums and one install line, and those checksums are cross-checkable against the checksums.txt published with the release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JfornbxxXRfnxqFXZSD7ym |
||
|---|---|---|
| Formula | ||
| .gitignore | ||
| LICENSE | ||
| README.md | ||
homebrew-wraptool
Homebrew tap for wraptool, an MCP server that wraps CLI tools behind a security whitelist so an AI coding assistant can use them without ever seeing the credentials.
Install
brew tap pti/wraptool https://forge.snamellit.com/pti/homebrew-wraptool.git
brew trust pti/wraptool
brew install pti/wraptool/wraptool
wraptool version
The clone URL is not optional: brew tap assumes GitHub, and this tap lives on
forge.snamellit.com.
Neither is brew trust. Homebrew does not trust a third-party tap by default,
and an untrusted tap is skipped with a warning during brew update rather
than reported as an error:
Warning: Skipping pti/wraptool because it is not trusted.
Run `brew trust pti/wraptool` to trust it.
Nothing looks broken — new versions simply never arrive. Trusting the formula
alone is not enough; trust the tap. brew untrust pti/wraptool reverses it.
Before you trust it
brew install executes the Ruby in this repository on your machine as your
user, and unlike homebrew-core, nothing here is reviewed by Homebrew
maintainers. The formula is deliberately small enough to read in a minute: four
URLs, four checksums, one install line.
Its SHA-256 values should match the checksums.txt published with the
corresponding wraptool release. They come from the same job that built the
binaries, so a mismatch means something happened after the build. Release tags
are PGP-signed; the fingerprint and trust model are documented at
Releases and changes.
If you would rather not extend that trust, the install script verifies a checksum you fetch yourself, at the cost of manual upgrades.
Upgrade
brew update && brew upgrade pti/wraptool/wraptool
What is in here
Formula/wraptool.rb, and nothing else. It installs the prebuilt wraptool
release binary — macOS and Linux, AMD64 and ARM64 — verified against the SHA-256
checksum published with that release, so it needs no compiler and no Go
toolchain.
The formula installs wraptool itself only. The AI harnesses it runs
(claude, agy, and friends) come from wraptool's own version-locked harness
pool, never from Homebrew. See the
harness pool documentation.
Do not edit the formula by hand
Formula/wraptool.rb is generated by wraptool's release workflow
(.forgejo/workflows/publish-binaries.yml) from the checksums of the build
being released, and committed here automatically by CI. A hand edit is
overwritten by the next release, and a hand-written checksum defeats the point
of publishing one.
Report formula problems on the wraptool issue tracker.
Documentation
License
GPL-3.0-or-later, the same license as wraptool.