Right now your agents are probably running on inherited API keys that can touch money, customer data, and production. AgentValet takes the keys back. It sits in the call path, gives each agent a scoped identity, holds the risky calls for a human, and writes every action to a receipt you can hand an auditor.
Govern the agents you already run, wherever they run. No new runtime to adopt, no sandbox to migrate onto.
npx @agentvalet/registerFree tier, no card. Live in 5 minutes, or we'll wire your first agent with you on a call.
"Dharmesh Shah, co-founder and CTO of HubSpot, described a valet key for AI agents: one that starts the car but won't open the boot or the front gate. I commented that I might build it. Then I did. I write the code, run it in production, and I've spent fifteen years in regulated Australian environments where a leaked credential is a genuinely bad day."
The agent inherits your raw API keys. It can read your email, write to your database, push to production, spend money, and delete files. None of that was intentional. It's just what "give the agent access" looks like with no governance in between.
Each agent has its own RS256 identity (a signing key that proves which agent is calling), granted only the scopes it actually needs. Risky calls pause for a human. Every action writes an append-only receipt. Revoke one agent in a click and nothing else is touched.
A walkthrough of the real decision path: policy, scope, approval, vault, proxy, audit. Flip the switch in the demo header to compromise the agent, then watch the same six gates stop it before a credential is ever issued.
Interactive. Starts when it scrolls into view. Toggle legitimate / malicious, or pause it.
npx @agentvalet/register. An RS256 keypair is generated (a private signing key plus a public one we can check it against). The public key goes to the registry, the private key never leaves your machine.Each one is a real control in the product, not a diagram. Every one of them works on the day you sign up.
Bring your own key. It stays on your machine, travels with each call, and is never vaulted or written down on our side. Your agent's calls relay through AgentValet and land in a live audit feed on a private link. Observe Mode applies no policy: it records what your agents do and blocks nothing, so it is a recording of real calls, not a safety net. We keep call metadata (platform, endpoint, method, status, timing) for 24 hours and then delete it, and we never keep your key, your request bodies, or the responses. No account is needed to start. When you're ready for full governance, sign in once and the trail comes with you.
One broker in front of everything your agents touch, so there's a single audit trail and a single place to pull the plug.
Point AgentValet at any third-party MCP server (the open standard agents use to reach tools) and it becomes a governed platform: the token is vaulted, the server's tools become scopes you grant per agent, and every call runs the same approval and audit path. No token on disk, no token in your config. AgentValet also runs its own hosted MCP server over OAuth 2.1.
The assumption underlying most secrets management is that if nobody can read the secret file, you're fine. That breaks the moment an agent runs with inherited API keys and no scope enforcement, because now a compromised agent or a careless scope grant becomes a master key.
AgentValet starts from a different position. Each credential gets its own AES-256 data encryption key, and that key is itself encrypted by a per-organisation master key, held on paid plans in tamper-resistant hardware that will not hand it back out. When a call comes in, the broker unseals the credential in memory for that one request and discards it. It never lands in a log, a response body, or a debug trace, and it never reaches the agent.
Scope enforcement runs first, before anything is unsealed. An agent without the right grant never gets that far. Risky actions pause for a human. Every decision, approved or denied, lands in the append-only audit log (rows can be added, never rewritten). Revoke an agent and the effect is immediate.
Not sure where your own gaps are? The Agent Exposure Scorecard maps your setup to the OWASP Top 10 for Agentic Applications 2026 in about two minutes, and shows your score with no email.
A growing class of tools promises agent governance by sitting between your application and the model: they filter which tools the model is shown, and they can withhold a tool call the model returns. That is real work and it has real value. But it governs the suggestion, not the action. The agent still holds its own credentials, and anything that skips the proxy (a direct API call, a second code path, a key already sitting in the environment) executes with no governance at all.
The gateway only sees the traffic you chose to route through it. The keys stay with the agent, so the control is advisory: remove the gateway and everything still works.
The credential lives only in the vault, never with the agent. Remove AgentValet and the agent has nothing to call with. That is the difference between advice and enforcement.
The two layers stack, by the way. If you already run a model-side gateway for context and cost control, keep it: filtering upstream and enforcement downstream are complementary. The full comparisons: Tenure, Permit.io, MCP gateways, and the default they all replace, raw keys in .env.
One MCP endpoint (a single address your agent host already knows how to talk to). Connect it in minutes, or register directly with npx @agentvalet/register. Nothing about your stack changes: same models, same frameworks, same agents. They just call through the broker instead of holding the keys.
A LangChain tool, a cron job, a plain Node or Python service: anything that isn't an MCP host talks to the broker through the client library instead. Same grants, same approvals, same audit log. The only credential on the machine is your agent's own identity key.
import { AgentValet } from "@agentvalet/client"; const av = AgentValet.fromEnv(); await av.call({ platform: "slack", endpoint: "/api/chat.postMessage", method: "POST", scope: "chat:write", data: { channel: "#general", text: "Deploy finished." }, }); // No Slack token in this file, this process, or the model's context. // Checked against your grants, credential injected at call time, // one audit row written.
And the part a diagram can't show you: what happens when the agent reaches for something you never granted. A denial is a typed error your code can branch on, not a stack trace.
import { AccessDeniedError } from "@agentvalet/client"; try { await av.call({ platform: "stripe", endpoint: "/v1/refunds", method: "POST", scope: "refunds:write", data: { charge } }); } catch (err) { if (err instanceof AccessDeniedError) { // Not a crash. A governance decision your code can act on. const decision = await av.requestAccess({ platform: err.platform, scope: err.scope, reason: "Refund duplicate charges flagged by support", }); } }
from agentvalet import AgentValet av = AgentValet.from_env() av.call( platform="slack", endpoint="/api/chat.postMessage", method="POST", scope="chat:write", data={"channel": "#general", "text": "Deploy finished."}, ) # No Slack token in this file, this process, or the model's context. # Checked against your grants, credential injected at call time, # one audit row written.
And the part a diagram can't show you: what happens when the agent reaches for something you never granted. A denial is a typed exception your code can branch on, not a stack trace.
from agentvalet import AccessDeniedError try: av.call(platform="stripe", endpoint="/v1/refunds", method="POST", scope="refunds:write", data={"charge": charge_id}) except AccessDeniedError as err: # Not a crash. A governance decision your code can act on. decision = av.request_access( platform=err.platform, scope=err.scope, reason="Refund duplicate charges flagged by support", )
Most multi-agent setups have a quiet flaw: the orchestrator holds the access, and every worker it spawns inherits all of it. The researcher that only needed to read one repo can post to Slack and touch production, because it runs on the supervisor's authority and nobody scoped it down.
AgentValet closes that gap with child identities. Before your orchestrator hands work to a subagent, one call mints a child: its own agent id, a lifetime you choose (minutes, not weeks), and only the slice of the parent's scopes that this worker actually needs. The attenuation is enforced at the broker rather than requested politely. The child's grants are written server-side as the intersection with the parent's live grants and re-checked on every call, so a worker can never hold a scope its parent has lost.
Things you can actually verify, not things I'm asking you to take my word for.
npx @agentvalet/registerPublished on npm. Works today. Free tier, no card required.
Every action through AgentValet writes a receipt you can export. If you ever find an agent action that isn't in your audit trail, that's on us: a full refund, and I'll help you move off. Check it free before you trust me.
It's still beta, and I'll tell you what isn't built yet rather than paper over it. Bring-your-own-key is in development. If you need something specific, ask me directly.
You pay for the calls your agents make, not for seats, not per agent. Register as many agents as you like on any plan. A quiet month costs less, and governance never becomes the reason you don't put an agent behind it. AgentValet is in beta: any plan you start now is locked in for as long as you stay subscribed.
Go past your plan's included calls and the work keeps running. Nothing is cut off mid-workflow, and your dashboard shows where you stand before the bill does.
Priced on what you actually run, agreed up front. Okta SSO live today, forensic audit (IP, geo, request ID on every action), per-user connection identity (the downstream system logs the person, not one shared bot), and the controls your security team will ask for before agents touch production. Run a scoped pilot with your real agents. If it doesn't satisfy your team, walk away.
The broker runs in ours, as a managed service, so there's nothing for your team to install or patch. The part that touches your machines is published on npm under MIT (the MCP server, the CLI, and the runtime adapters, plus the desktop bundle, built from the same MIT source), so you can read it, fork it, and see exactly what runs where your keys and code live. Your agents stay exactly where they are; only the outbound call path changes. Enterprise customers can ask for a dedicated managed tenant in a specific region.
Four things, in order. It's deny-by-default (an agent can call nothing until you grant a specific scope). Three layers then have to agree on that call: your org guardrails, the owner's policy, and the agent's own grant. Anything risky hits approval-as-policy (it stops and waits for a human to okay it). And it's a keyless bind (the agent never holds the credential), so even a fully compromised agent has nothing to steal and nothing to reuse somewhere we can't see.
Yes, and you don't move anything to make it work. AgentValet is model-agnostic and framework-agnostic: it governs the call to the real system, not the model that decided to make it. It's MCP-native (it speaks the open protocol your agent host already uses for tools), so Claude Code, Cursor, Codex, Claude Desktop and others connect by adding one endpoint. Anything that can make an HTTP request and sign a short-lived token can use it, including code you wrote yourself.
Every call writes one row at the moment it's decided: timestamp, owner, agent, platform, action, the outcome, the reason, and the exact policy version that produced it. The table is append-only at the database level (the application holds INSERT rights and nothing else, so no product path can rewrite history). That gives an auditor a complete, ordered decision record they can reconstruct a session from, exportable to CSV, JSON, or PDF on Team and up. It's a decision record rather than a packet capture (it proves what was decided and which rule decided it, without keeping the contents of each request).
The governance itself is free. On the Free plan you get per-agent identity, deny-by-default scopes, human approval, keyless bind, and the audit log, on a real agent, with no card. Observe Mode (a recording of what your agents already do, with no policy applied and nothing blocked) is free too, and doesn't need an account. Paid plans are priced on what you actually run: more call volume, longer audit retention, export, push approvals, delegated approvers, and the multi-user and forensic controls a security team asks for.
An API key is a static secret that can't prove who is holding it. AgentValet gives each agent an RS256 keypair instead (a private signing key that never leaves its machine), so every request is attributable to one named agent. Scope enforcement, approval, and the audit trail sit on top of that identity. Revoking one agent doesn't mean rotating a key across every system it ever touched.
Their own, if you want the guarantee. A registered agent can mint a short-lived child identity for each worker it spawns: one call, and the child gets its own agent id, a lifetime you choose, and scopes attenuated server-side to a subset of the parent's live grants. Every call the worker makes is audited under its own name, and revoking the parent contains every child on its next call. Chains are one level deep by design. It's in the Python SDK (issue_child, 0.2.0+), the REST API, and as an MCP tool; the LangGraph guide shows the full pattern.
An LLM gateway sits between your application and the model. It can shape what the model sees and veto the tool calls the model suggests, which is useful for context and cost control. But the agent still holds its own credentials, so any call that doesn't pass through the gateway is ungoverned, and removing the gateway changes nothing about what the agent can reach. AgentValet sits between the agent and the platform, and it holds the credential. There is no path to the platform that skips it, because the agent never has a key to use. The two stack cleanly: filter context at the model, enforce at the execution. See the full comparison.
Revocation is immediate and cascading. The public key leaves the registry, every scope grant is invalidated, in-flight requests are rejected rather than drained, and the stored OAuth refresh-token chain is revoked upstream so the access can't be quietly resumed. Nothing else in your org is touched.
Start on the free tier and run your first agent through it. You'll know within an hour. If the audit trail and approval flow don't satisfy your team, walk away.