About
Built for the morning after you gave an agent a production key
Coding agents got good enough to be useful and, on the same afternoon, good enough to be dangerous. The keys they hold are the ones your business runs on. This is the layer that keeps them working without the keys.
The bet
Executing the call is a different product from handing over the token
Nine vendors put the key on the request for you. All of them still hand the agent a raw token somewhere. The specification for the protocol these agents speak says the opposite in as many words. A server holding tokens bound to a user must not transmit them to the client. We took that sentence as the product.
- Approval next to injection
- A card a person answers while the call waits. Not a policy engine, not a nightly report.
- A journal that verifies without us
- Hash-chained per tenant, sealed from its writer, with checkpoints you keep and a verifier that holds none of our keys.
- Three doors, one broker
- MCP, arbitrary HTTP and SSH under one policy. Every competitor covers one of the three.
The rules
Four rules that will each look relaxable
They are written down because every one of them will look like a reasonable thing to bend on a Friday.
- Minimum friction is a requirement, not a preference
- An agent sees every key and service it may use, up front, in human words. A refusal caused by configuration is a bug in this product.
- There is no read path for a credential value
- Not for an owner, not for support, not over the API. One unwrap, from the engine, for a call already on its way out.
- An agent can never aim the gateway at the gateway
- Our own hostnames and addresses are compiled into the deny list, with one deliberate exception for the demo endpoint the onboarding call uses.
- The journal is written before the side effect
- The intent row and the chain update share one transaction with the dispatch decision. A record written afterwards is a record that can be missing.
Who we build for first
The people running agents on somebody else's systems
Agencies and consultancies point agents at their clients' infrastructure every day, and no vendor with a published price sells a client workspace. A vault, an approver group and an exportable journal per client is a data model. A feature list does not grow one later.
Second: teams in Kazakhstan and Russia, where the American vendors in this category geoblock. The same binary runs on a dedicated deployment in your own region.
Start with one key and one agent
The first loop finishes in the console, and it takes one approval on your phone.
Free for 10,000 calls a month. No card.