Web-based AI interfaces like Claude, ChatGPT, and Gemini are fantastic for brainstorming, but completely cut off from your local repository files.

To bridge this securely, TokenCap implements a local HTTP daemon via tokencap serve adhering to Bridge Contract v1.

Security Architecture of the Bridge

  1. Loopback Binding: The daemon listens exclusively on 127.0.0.1:4545. It never binds to 0.0.0.0 or public network adapters.
  2. Ephemeral Token Auth: When starting, a random hex token is generated and stored locally in ~/.tokencap/. Requests must provide this token via the X-TokenCap-Token header.
  3. Strict Origin Checks: Pre-flight CORS filters block unauthorized web domains. Only approved extension origins can read responses.

Running in the Terminal 

# Start in the foreground tokencap serve # Or run as a detached background daemon tokencap serve --daemon # Stop the daemon tokencap serve --stop

Console Output:

TokenCap bridge on http://127.0.0.1:4545 Pair the companion: http://127.0.0.1:4545/?pair=8f1c3a09e2 Bridge context pre-warmed in 280ms. Serving intelligence for: /Users/dev/repos/api-backend

Because the bridge pre-warms intelligence in memory, subsequent context generation queries take milliseconds.

Explore the bridge contract at tokencap.vansharora.app