Identity · Scopes · Approvals · Audit

Give your agents a valet key, not your house keys.

AgentValet sits between your agents and the platforms they call. Each agent gets its own identity, scoped to exactly what it needs. You approve the risky calls. Every action leaves a receipt you can hand an auditor.

Built for teams whose agents touch money, customer data, and the systems your auditors ask about.

npm: @agentvalet/register 30 platforms live append-only audit · INSERT-only RLS Okta SSO live

Free tier, no card. Live in 5 minutes, or we'll wire your first agent with you on a call.

audit · liveagent: invoice-processor
14:02:11github · repo.read · firstaml/ledger✓ ALLOW
14:02:13slack · chat.write · #finance-ops✓ ALLOW
14:02:19stripe · charge.create · $4,200.00⏸ HOLD
14:02:24gmail · mail.delete · all✕ DENY
append-only · INSERT-only RLSsigned RS256
A governed agent on a finance workflow: allowed, held for approval, denied, every decision logged.
Why this exists

Built by someone who runs this in production.

Edwin Ashdown, founder of AgentValet

"Dharmesh Shah, co-founder and CTO of HubSpot, described a valet key for AI agents: one that starts the car but won't open the boot or the front gate. I commented that I might build it. Then I did. I write the code, run it in production, and I've spent fifteen years in regulated Australian environments where a leaked credential is a genuinely bad day."

Edwin Ashdown · Founder, AgentValet · Brisbane · LinkedIn
The default we reject

House key or valet key? Most agents are running with the wrong one.

● House key agent, today's default
Full keyring. Every door.

The agent inherits your raw API keys. It can read your email, write to your database, push to production, spend money, and delete files. None of that was intentional. It's just what "give the agent access" looks like with no governance in between.

  • No cryptographic identity per agent
  • No scope limits on what it can call
  • No human gate on risky actions
  • Revoking means rotating every key it touched
● Valet key agent, with AgentValet
Starts the car. Nothing else.

Each agent has a unique RS256 identity, granted only the scopes it actually needs. Risky calls pause for a human. Every action writes an immutable receipt. Revoke one agent in a click and nothing else is touched.

  • Cryptographic identity per agent (RS256)
  • Deny-by-default scopes, granted per action
  • Human approval before anything risky runs
  • One-click revocation, instant and cascading
How it works

From zero to governed in three steps. No keys in your repo.

01
Register your agent
Run npx @agentvalet/register. An RS256 keypair is generated; the public key goes to the registry, the private key never leaves your machine.
02
Grant scopes
Connect platforms and grant each agent precisely what it needs: read-only on one GitHub account, write on one Slack channel, nothing else. Credentials are envelope-encrypted in a Key Vault HSM.
03
Call through the proxy
The agent calls with a short-lived JWT. The proxy verifies, checks scope, decrypts in-memory, forwards, and writes an audit row. Risky calls pause for your approval.
Observe Mode, free, no signup

Watch every call your agent makes before you commit to anything.

Bring your own key. Your agent's calls relay through AgentValet and land in a live audit feed on a private link. Nothing is stored on our side. No account needed to start. When you're ready for full governance, the trail converts in one click.

Start observing free
What you get

One governed surface for everything your agents reach for.

One proxy in front of everything your agents touch, so there's a single audit trail and a single place to pull the plug.

GOVERNED MCP
Paste an MCP server URL. AgentValet wraps it.

Point AgentValet at any third-party MCP server and it becomes a governed platform: the bearer token is vaulted, the server's tools become scopes you grant per agent, and every call runs through the same approval and audit path. No token on disk, no token in your config. AgentValet also runs its own hosted MCP server over OAuth 2.1.

MCP server URL
https://your-mcp-server.io/mcp
Token, header, and query auth today. OAuth-mode coming soon.
Multiple accounts per platform
Two GitHub logins, three Google accounts, different Slack workspaces, each kept distinct. Grant scopes per connection. The audit log records which account acted, every time.
Ask Valet, plain-English policies
Press ⌘K and say "never let any agent send email without my approval." AgentValet drafts the policy for you to review. You decide what ships. Guardrails described in natural language, enforced in the proxy.
Org-wide policies
Set a guardrail once and every agent obeys it. Deny wins in a fixed cascade: org guardrails, then per-owner policy, then per-agent scope check. All three have to agree before a call is allowed.
Security model

Credentials that are genuinely hard to misuse.

The assumption underlying most secrets management is that if nobody can read the secret file, you're fine. That breaks the moment an agent runs with inherited API keys and no scope enforcement, because now a compromised agent or a careless scope grant becomes a master key.

AgentValet starts from a different position. Each credential gets its own AES-256 data encryption key, itself encrypted by a master key held in a Key Vault HSM. When a call comes in, the proxy decrypts the credential in-memory for that single request, then discards it. It never lands in a log, a response body, or a debug trace.

Scope enforcement runs before decryption. An agent without the right grant never triggers a decrypt at all. Risky actions pause for a human. Every decision, approved or denied, lands in the append-only audit log. Revoke an agent and the effect is immediate.

Not sure where your own gaps are? The Agent Exposure Scorecard maps your setup to the OWASP Top 10 for Agentic Applications 2026 in about two minutes, and shows your score with no email.

Identity
RS256 keypair per agent. Private key never leaves the agent machine. Every request verified against the public key in the registry. No shared secrets.
Encryption
Envelope encryption: AES-256 DEK per credential, master key in a Key Vault HSM. Decrypted in-memory at call time only. Never logged.
Governance
Deny-by-default scopes. Human approval on risky calls. Append-only audit. Instant revoke. Circuit breaker auto-suspends on 3 auth failures.
Works with your tools

Claude Code, Cursor, Codex, Hermes, Paperclip, and your own scripts.

One MCP endpoint. Connect it to your host in minutes, or register directly with npx @agentvalet/register. Every agent gets cryptographic identity, scoped credentials, and a full audit trail regardless of which tool is running it.

See all integration guides →
Why trust this

Product proof, not promises.

Things you can actually verify, not things I'm asking you to take my word for.

THE REAL INSTALL COMMAND
npx @agentvalet/register

Published on npm. Works today. Free tier, no card required.

LIVE TODAY
  • 30 platform integrations live (Airtable, Gmail, Slack, GitHub, HubSpot, Xero, and more)
  • MCP server on npm, installable right now
  • Append-only audit log enforced at the database level (INSERT-only RLS)
  • Envelope encryption with Key Vault HSM
  • Okta SSO live on Enterprise via verified domain
✓ The audit guarantee

Every action through AgentValet writes a receipt you can export. If you ever find an agent action that isn't in your audit trail, that's on us: a full refund, and I'll help you move off. Check it free before you trust me.

HONEST BETA LINE

It's still beta, and I'll tell you what isn't built yet rather than paper over it. Bring-your-own-key is in development. A handful of integrations are in testing, not yet live. If you need something specific, ask me directly.

Pricing

Early access pricing. Lock it in before launch.

AgentValet is in beta. Early-adopter pricing goes up at GA, and any plan you start now is locked in for as long as you stay subscribed. Usage beyond your plan is metered, never cut off mid-workflow.

Free
$0 forever
 
For your first agent. No card.
  • 1 agent
  • 2-day audit log
Start free
Solo
$19 /mo
 
Get started, test the waters.
  • 3 agents
  • 1,000 calls included
  • 7-day audit log
  • Email support
  • 30-day money-back
Get started
Beta rate, yours for life
Studio
$59 /mo
 
Real agent workflows.
  • 15 agents
  • 10,000 calls included
  • 30-day audit log
  • Email support
  • 30-day money-back
Get started
Team
$129 /mo
 
Agencies and operators.
  • 50 agents
  • 50,000 calls included
  • 1-year audit + export
  • Mobile push approvals
  • Priority support
Get started
Estimate your bill (Studio)
At 10,000 calls/mo: $59.00/mo
At this volume, Team at $129 may be better value →
ENTERPRISE
Governed agent access for the whole org

Okta SSO live today, forensic audit (IP, geo, device, request ID), per-user OAuth identity, and the controls your security team will ask for before agents touch production. Run a scoped pilot with your real agents. If it doesn't satisfy your team, walk away.

Book a call → See the Enterprise overview
FAQ

API keys are static secrets that can't prove who is using them. AgentValet uses per-agent RS256 keypairs. The private key never leaves the agent, so every request is cryptographically attributed. Scope enforcement, human approval, and an append-only audit trail come on top.

Credentials never sit in plaintext anywhere a person can read them. Each one gets a unique AES-256 key; the master key lives in a Key Vault HSM; decryption happens in-memory at call time only. Never logged. Every decrypt is audited.

Revocation is immediate and cascading. The public key is removed from the registry, all scope grants invalidated, in-flight requests rejected, and the stored OAuth refresh-token chain revoked so the upstream grant can't be reused.

Yes. AgentValet is agent-agnostic. The CLI registers any agent that can sign a JWT. For Claude Code, npx @agentvalet/register injects the right config automatically. Any agent that can make HTTP requests can use the proxy.

The audit log is backed by PostgreSQL with row-level security that allows only INSERT. No UPDATE or DELETE through any app or agent path. On Team and up you can export the full trail to CSV, JSON, or PDF for your SIEM or compliance tooling.

Try it before you trust it.

Start on the free tier and run your first agent through it. You'll know within an hour. If the audit trail and approval flow don't satisfy your team, walk away.