NewToolDeveloper toolbox
A kernel-first developer toolbox: a Rust algorithm kernel underneath (the newtool CLI) and a Tauri 2 desktop app with a React shell on top. One kernel serves three consumers — AI (skill packages / MCP), humans (desktop app) and the browser (wasm).
01$ newtool list --json02{ "count": 3, "algorithms": ["base64", "jwt.decode", "uuid.v7"] }0304$ newtool run jwt.decode --params '{"token":"eyJhbGci..."}'05{ "ok": true, "data": { "header": { "alg": "HS256" } } }The algorithm is written once; people and AI run the same implementation.
Design decisions
Why this tool is built the way it is, and what that buys.
Every algorithm is implemented in Rust; the UI is only a shell. No tool logic is rewritten in the UI layer — everything goes through the Rust kernel or the React presentation layer, so behaviour cannot drift across clients.
Distributed as skill packages to WorkBuddy / Codex / Claude Code; AI calls list / describe / run directly, with no human opening a UI.
tool.toml declares the four effective forms — app / cli / web-wasm / web-server; the manifest is the sole source of visibility.
Remote clients connect straight to newtool-server over MCP and reach every algorithm without installing a local binary.
Capabilities at a glance
- The Rust algorithm kernel is the single source of truth: the manifest is the contract, and build.rs fails the build on drift
- Three consumers share one kernel: AI skill packages, the Tauri desktop app, and browser wasm bindings
- Remote use goes through MCP (streamable HTTP) with zero local binaries
- CLI contract: stdin → stdout, a unified envelope, and discover / describe
- Declarative tool definitions: tool.toml describes parameters and form; build scripts generate pages and registries
- Self-built engines as standalone crates: cipher / css / json / diff / yaml / id / text
Design metrics
Each one maps to a concrete decision in the implementation.
Everything lives in newtool-core; no UI layer rewrites algorithm logic
AI (skill packages / MCP), humans (desktop app), browsers (wasm)
Declared in tool.toml: app / cli / web-wasm / web-server
cipher / css / json / diff / yaml / id / text as standalone crates
A manifest/code mismatch fails the build outright and never reaches runtime
Remote scenarios connect over MCP — no local binaries required
Platform support
With kernel and shell separated, support levels can advance independently per platform.
The Tauri 2 desktop app; the React shell shares one kernel
The newtool command, with the unified stdin → stdout envelope
The kernel compiles to wasm; usable offline, nothing to install
streamable HTTP; remote access with zero local binaries
skills/newtool-toolbox distributes to WorkBuddy / Codex / Claude Code
How it differs from the common approach
The difference usually is not in the feature table — it is in where the boundary is drawn.
Commands at a glance
For the full manual, see the CLI reference page. All commands output structured results by default.
newtool listList all algorithms and their effective forms
--json--status rust|todonewtool describe <algo>Show an algorithm’s parameter definitions, forms and examples
--jsonnewtool run <algo>Run an algorithm, passing parameters via stdin or --params
--params--stdin--jsonnewtool mcp serveExpose all algorithms over MCP streamable HTTP
--port--hostActual output
01$ newtool list --json02{ "count": 3, "algorithms": ["base64", "jwt.decode", "uuid.v7"] }0304$ newtool run jwt.decode --params '{"token":"eyJhbGci..."}'05{ "ok": true, "data": { "header": { "alg": "HS256" } } }Modules
4 groups, 14 modules — all from the repository’s real directory structure.
Rust · Tauri 2 · React · TypeScript · WASM · MCP · TOMLWhere algorithms are written exactly once.
crates/newtool-coreA pure-function algorithm kernel with no IO, callable by CLI, desktop and wasm at once
crates/newtool-corecrates/newtool-cliThe CLI contract: stdin → stdout, a unified envelope, discover / describe
crates/newtool-cliEach one a standalone crate, reusable on its own.
newtool-cipherCipher, encoding and decoding algorithms
libs/newtool-ciphernewtool-cssCSS processing and formatting
libs/newtool-cssnewtool-json / newtool-yamlJSON and YAML parsing, transformation and validation
libs/newtool-{json,yaml}newtool-diffText diffing
libs/newtool-diffnewtool-idID generation (UUID v7 and friends)
libs/newtool-idnewtool-textText processing and transformation
libs/newtool-textThe sole source of visibility is the manifest, not code comments.
manifests/algorithms.tomlThe single source of truth for algorithms; status = rust force-syncs the registry
manifests/algorithms.tomlbuild.rs guardIntercepts manifest/code drift at build time — drift fails the build
crates/*/build.rstool.tomlDeclaratively defines tool parameters and the four effective forms: app / cli / web-wasm / web-server
tools/*/tool.tomlOne kernel, three consumers.
Tauri 2 desktop shellThe React shell + three kernel-client adapters (tauri / http / wasm)
apps/desktopskills/newtool-toolboxThe skill package distributed to WorkBuddy / Codex / Claude Code; AI calls it directly
skills/newtool-toolboxMCP serverstreamable HTTP; remote access with zero local binaries
newtool-serverUsage
4 typical scenarios, each broken into steps you can follow.
No web pages, no extensions — compute straight from the CLI or the desktop app.
- 1newtool list to find the algorithm you need
- 2newtool describe to confirm parameter shapes
- 3newtool run to execute, with JSON results piped directly
- 4The same algorithm is also available graphically in the desktop app
AI never opens a UI; list / describe / run are the whole story.
- 1Install the skill package or connect to the MCP endpoint
- 2AI calls list for the available algorithm registry
- 3describe returns the parameter schema
- 4run executes and the structured result is read
The kernel compiles to wasm: it works offline and data never leaves the browser.
- 1Open the web edition; the kernel loads as wasm
- 2Input data is processed on the machine
- 3No server requests of any kind
- 4Suited to handling sensitive text and key material
The algorithm is written once, so humans, AI and every client behave identically by construction.
- 1The algorithm is implemented in newtool-core and registered in the manifest
- 2build.rs intercepts manifest/code drift at build time
- 3CLI, desktop and wasm reuse the same implementation
- 4A new algorithm needs only a manifest entry and an implementation; every client sees it automatically
Data boundary and security
Much of the value of this kind of tool is in what it does not do. Every item below notes where it is implemented.
In desktop and wasm forms, data never leaves the machine; sensitive text and key material never need uploading.
newtool-core: pure functions, no IOThe algorithm kernel is pure functions with no network or file access — a small attack surface.
crates/newtool-coreManifest/implementation drift fails at build time, preventing “documented but missing in code”.
build.rs guardCLI output shares one structure, so AI consumers never misread because of format drift.
stdin → stdoutThe desktop shell requests no system permissions beyond what it needs, and the algorithms never touch user directories.
Tauri 2 permission configThe discover / describe algorithm registry is itself the audit entry point.
manifests/algorithms.tomlRelease cadence
Shipped items state what was delivered; in-progress items state what is being built.
v0.4ReleasedKernel- The newtool-core pure-function algorithm kernel
- The newtool-cli unified envelope
- Seven in-house engine crates
- A manifest-driven registry
v0.7ReleasedMulti-platform- The Tauri 2 desktop app
- The three kernel-client adapters (tauri / http / wasm)
- The browser wasm edition
- The build.rs drift guard
v0.9In developmentAI distribution- The skills/newtool-toolbox skill package
- The MCP streamable HTTP endpoint
- Visual browsing of the algorithm registry
- Batch and pipeline modes
v1.0PlannedEcosystem- An algorithm marketplace and third-party contributions
- Team-shared presets and snippets
- IDE plugins
- Algorithm versioning and compatibility policy
FAQ
Because one kernel must serve three consumers: AI skill packages, the desktop app and browser wasm. Rust compiles one implementation to both native and wasm targets, preventing behavioural drift across clients — the precondition for “algorithms written once”.
Modules
4 groups, 14 modules. Paths map directly to repository directories, so engineers can locate code fast.
Where algorithms are written exactly once.
crates/newtool-coreA pure-function algorithm kernel with no IO, callable by CLI, desktop and wasm at once
crates/newtool-corecrates/newtool-cliThe CLI contract: stdin → stdout, a unified envelope, discover / describe
crates/newtool-cliEach one a standalone crate, reusable on its own.
newtool-cipherCipher, encoding and decoding algorithms
libs/newtool-ciphernewtool-cssCSS processing and formatting
libs/newtool-cssnewtool-json / newtool-yamlJSON and YAML parsing, transformation and validation
libs/newtool-{json,yaml}newtool-diffText diffing
libs/newtool-diffnewtool-idID generation (UUID v7 and friends)
libs/newtool-idnewtool-textText processing and transformation
libs/newtool-textThe sole source of visibility is the manifest, not code comments.
manifests/algorithms.tomlThe single source of truth for algorithms; status = rust force-syncs the registry
manifests/algorithms.tomlbuild.rs guardIntercepts manifest/code drift at build time — drift fails the build
crates/*/build.rstool.tomlDeclaratively defines tool parameters and the four effective forms: app / cli / web-wasm / web-server
tools/*/tool.tomlOne kernel, three consumers.
Tauri 2 desktop shellThe React shell + three kernel-client adapters (tauri / http / wasm)
apps/desktopskills/newtool-toolboxThe skill package distributed to WorkBuddy / Codex / Claude Code; AI calls it directly
skills/newtool-toolboxMCP serverstreamable HTTP; remote access with zero local binaries
newtool-serverTech stack
Layered design
From kernel to shell — what each layer owns and what it is built with. The core design of these tools is separating kernel from shell.
crates/newtool-core, pure functions with no IO, plus crates/newtool-cli providing the newtool command
libs/newtool-{cipher,css,json,diff,yaml,id,text} as standalone crates
manifests/algorithms.toml is the single source of truth; status = rust force-syncs the registry
The Tauri 2 + React shell with three kernel-client adapters (tauri / http / wasm)
The skills/newtool-toolbox skill package + MCP streamable HTTP
Rust · Tauri 2 · React · TypeScript · WASM
Multi-platform support
One kernel; a different platform is just a different shell. Support levels can advance per platform.
The Tauri 2 desktop app; the React shell shares one kernel
The newtool command, with the unified stdin → stdout envelope
The kernel compiles to wasm; usable offline, nothing to install
streamable HTTP; remote access with zero local binaries
skills/newtool-toolbox distributes to WorkBuddy / Codex / Claude Code
Tech stack
Command reference
6 commands. Design premises: structured output and semantic exit codes, so both scripts and AI agents can consume them reliably.
newtool listList all algorithms and their effective forms
--json--status rust|todonewtool describe <algo>Show an algorithm’s parameter definitions, forms and examples
--jsonnewtool run <algo>Run an algorithm, passing parameters via stdin or --params
--params--stdin--jsonnewtool mcp serveExpose all algorithms over MCP streamable HTTP
--port--hostnewtool webStart a local browser UI backed by the same kernel
--port--opennewtool skills installInstall the skill package that distributes the toolbox to AI clients
--target workbuddy|codex|claudeOutput conventions
The CLI is an interface for programs; humans being able to read it is a side effect.
JSON by default, with stable field names. Human-readable formatting is the caller’s decision, not something the CLI guesses.
Success, failure and usage errors return distinct exit codes, so scripts and agents branch on the code instead of parsing text.
Local token files are discovered automatically, avoiding plaintext credentials on the command line (which would land in shell history and process lists).
One real invocation
01$ newtool list --json02{ "count": 3, "algorithms": ["base64", "jwt.decode", "uuid.v7"] }0304$ newtool run jwt.decode --params '{"token":"eyJhbGci..."}'05{ "ok": true, "data": { "header": { "alg": "HS256" } } }Hand the complexity of identity, agents and private domain to one governable kernel
Whether you are replacing an existing IAM, building an agent platform, or trying to make private-domain operations actually work — start with a 30-minute architecture call. We will first judge whether this is the kind of problem we are good at, and say so plainly if it is not.