Big Arrow vs Permit MCP Gateway

Big Arrow 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Installs with one Homebrew command and needs no signup (20).

Permit MCP Gateway 10

No machine payment protocol (0). Approvals are Enterprise only through a demo, and the gateway has no public price (0). Evaluation starts free on the hosted gateway, but approvals aren't in it, so 10 of 20. A person signs in through the browser consent flow (0).

Big Arrow 75

Read with the local-software lines, since the owner runs the binary. First commit 8 October 2026. Installs from the author's Homebrew tap, which builds v0.5.1 from the tagged source and since 0.5.1 needs only the Command Line Tools, not Xcode, or as an ad hoc signed universal binary on GitHub Releases, with macOS 14 stated (20). CI runs SwiftLint in strict mode, a release build and swift test with the window-server tests switched on. The last 25 runs on main had passed by 15 October 2026, per the 15 October check, not re-read on 1 November because GitHub's pages answered 403 (25). Per the 15 October check, two open issues, a request for Windows and Linux and a note of thanks, and no open bug, with the one outside bug report fixed with a regression test in v0.4.3 the day it arrived. The issue list wasn't re-read on 1 November. The 0.5.1 changelog closes out #70 (the ports) and #71 (the Homebrew formula) (20). Keep a Changelog and semantic version tags, but flags removed or replaced in 0.2.0, 0.3.0 and 0.5.1 (--raise, --shadow, --duration on cards) are listed under Changed, not marked as breaking (10). Version 0.5.1, not 1.0 and not declared stable (0).

Permit MCP Gateway 47

Permit's status page at permit-io.instatus.com lists the backend, OPAL, frontend, website and PDP services, at 100 per cent, but not the gateway or agent.security (10 of 20). With no gateway component there's no incident history for it (5). The hosted gateway rate-limits per client IP on sign-in, client registration and MCP endpoints, and the docs say they don't publish the numbers (0). A 429 carries a rate_limited JSON body and the docs say to back off and retry with growing waits (12 of 15). Enterprise has a 99.99 per cent uptime option (10). Approvals carry an Enterprise label, not beta (10).

Big Arrow 70

v0.5.1 on 26 October 2026 (30). Fifteen tagged releases between 8 and 26 October 2026 (20). The Hacker News thread was triaged into ten tickets, closed the same day, and two outside pull requests were declined with reasons in the triage note. Two outside issues opened on 12 and 13 October had no maintainer reply by 15 October, per the 15 October check. On 26 October 0.5.1 linked the ports made by people from #70 and dropped the Xcode requirement after an outside pull request to the tap (#71), but the issue pages couldn't be re-read on 1 November (12 of 25). Not an MCP server and no SDK, and the skill is not in a registry (0). One dependency, current Swift 6 tooling, CI on every push to main. No Dependabot configuration found (8).

Permit MCP Gateway 43

No release notes for the gateway. The docs record new gateway capability on 2026-07-28 and 2026-07-30 (the HTTP egress proxy) and a rewrite on 17 and 20 September (20 of 30). Those are docs commits, not releases or changelog entries, so part credit for visible activity (5 of 20). Closed service with a Slack community and support email, and the public changelog stopped in May 2024 (5 of 15). Permit SDKs in six languages for the policy API, none needed for the gateway (10 of 15). Nothing to install, so we score package health on the public docs repository's CI alone (3 of 10).

Big Arrow 78

Graded on the CLI and its skill. Every command takes --json, and exit codes 0, 1, 2, 3 and 4 are a stated contract. Cue cards (0.5.0) take a JSON document with 13 row types that rejects unknown keys, but no JSON Schema for input or output is published and other inputs are command flags (10 of 25). The skill is Markdown in the Agent Skills format written for agents, with a 153-word description, SKILL.md and a reference loaded on demand. The README's token counts (182, 1,528 and 1,118) date from 10 October and predate the card sections, which took SKILL.md from 680 to 981 words and the reference from 354 to 627 (10). The skill says when to use it, including a mandatory trigger for time-critical steps and when to use a card rather than a sign, and when not to, such as never walking a person through menus and skipping the close button unless asked (18). Flags are typed by swift-argument-parser with value lists for shape, style, size, border and colour presets, and the formula's test checks that an unknown size exits 2. The sign text is free text by design (12). The README and skill carry many worked commands, 20 card use cases sit in docs/cards, and exit codes and the permission errors are documented, with a not-found error that lists what exists (13). Semantic versions and a dated changelog (15).

Permit MCP Gateway 53

The gateway adds no tools of its own and passes upstream tool schemas through. Permit's management API has an OpenAPI-backed reference (15 of 25). No llms.txt or Markdown copies of the docs found (0). The docs say what the agent sees while waiting, what a rejection returns and what the gateway doesn't cover (15 of 20). Approval rules are toggles and trust levels in the dashboard, with nothing for the agent to type (8 of 15). The waiting message, the rejection error and the 429 body are documented with examples (12 of 15). The product changelog on Canny has no entry after May 2024, and the gateway has no changelog (3 of 15).

Big Arrow 63

MIT in LICENSE and in the Homebrew formula, with the bundled Feather icons' MIT licence in THIRD_PARTY_NOTICES.md (30). No privacy policy. The README says there is no daemon, account or telemetry and that card secrets never reach disk, and the source we read has no network code, which agrees. Sign text, which can hold a value to paste, sits in a per-user temporary file while the arrow is shown, which the README does not mention (15). No deprecation policy. Removed and renamed flags are named in the dated changelog (4). No telemetry to disclose, and the README says so. Nothing is sent, so there is nothing to opt out of (16).

Permit MCP Gateway 43

Closed service under terms updated 2026-07-01 that name Permit Inc., a Delaware corporation, under Delaware law (15 of 30). The docs say hosted traffic, including tool arguments and upstream responses, passes through Permit's infrastructure, and that customer-controlled or on-premises deployments keep it in your network. The terms let Permit delete data on termination, and audit log retention is by request (15 of 30). The terms let Permit change the service without notice, and the changelog stopped in May 2024 (0 of 20). Data location depends on the deployment model and is documented, but we found no subprocessor list (10 of 20).

Big Arrow 67

No credential model to grade, since the tool holds no secret of its own and makes no network call, so read with the framework lines as for other local agent tools. 30 for what leaves the machine by default, 20 for least privilege and approvals, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No network code, telemetry or account found in the source, and the only dependency is swift-argument-parser. A card's link row opens in the browser only when the person clicks it (30). It never clicks, types or captures, drawing needs no permission, and Accessibility is needed only for label targeting. Boxes and rings are outlines, the sign keeps clear of its target, and a click on the sign removes it. Since 0.5.0 a card can put a decision to the person with buttons and return it to the agent, and secrets go on a card from pass:, keychain:, op:, env: or file:, never the command line, show masked, copy as concealed and leave the clipboard after 30 s, per the README and source. Raising the target app is on by default with --no-raise to opt out (18). The skill tells the agent to put on the sign what an approval, payment or deletion does. Element labels read from other apps return as text the agent reads, with no guidance on treating them as untrusted (9). Live arrows are recorded in $TMPDIR/bigarrow/<pid>.json, sign text included, while shown, and a card's reply is written there with mode 0600 and no secret values until wait reads it. --json reports how each ended. No persistent log (6). No SECURITY.md, security.txt, bug bounty or advisories. The main branch is protected against force pushes and deletion, and the release binary is signed ad hoc and not notarised (4).

Permit MCP Gateway 80

OAuth 2.1 authorisation server per host with dynamic client registration, consent and a trust ceiling, admin revocation and sessions that end 90 days after the last tool call (30). Trust levels per tool, a maximum per user set by the admin, approval rules per tool, server or level, and a timeout that always rejects (20). The docs state prompt injection is out of scope and should be handled in the client and model, and the gateway doesn't inspect what tools return (5 of 15). Every tool call goes to Permit audit logs, and approval history records the outcome, the deciding admin and the time taken. Audit log retention isn't published (13 of 15). SOC 2 Type II and HIPAA per the deployment docs. We found no disclosure policy and couldn't check security.txt (12 of 20).