Claude Code can run any command you can. Keep your API keys out of its reach.
Claude Code works from your shell, so any token in that shell is its token too. With AgentValet it holds one agent key instead, and every platform call is checked against what you granted, held for you when it’s risky, and recorded.
One command, then approve in the browser
You need Node.js 18 or later and Claude Code installed. The CLI signs you in through your browser, so there’s no account to set up first.
In your project directory, run the register command.
Terminal npx @agentvalet/registerYour browser opens. Sign in, or create a free account, and the CLI finishes registering when you authorise it. You don’t copy any ids on this path.
Restart Claude Code, then run
/mcp. You should see agentvalet in the list.Claude Code /mcpIn the dashboard, approve the new agent and grant the platforms it needs. It starts with nothing: every call is refused until you grant it.
Connect over OAuth instead, with no key file
This path needs your owner id. It’s in the dashboard under Settings, Account, Owner ID. The Connect Claude, ChatGPT, Copilot… button on the Agents page builds the whole URL for you.
Add AgentValet as a remote MCP server.
Terminal claude mcp add --transport http agentvalet https://api.agentvalet.ai/mcp/v1/<owner-id>Run
/mcpin Claude Code. Your browser opens; sign in and approve. AgentValet creates a new agent for this connection with nothing granted, and Claude Code keeps the token itself.Grant that agent its platforms in the dashboard.
Write the MCP config by hand
Run npx @agentvalet/register once first. It creates the key on this machine and prints the four values below when it finishes. The MCP server needs all four; an entry without them won’t start.
Add this to
.mcp.jsonin your project, or to~/.claude.jsonfor every project..mcp.json { "mcpServers": { "agentvalet": { "command": "npx", "args": ["-y", "@agentvalet/register@latest", "mcp-server"], "env": { "AGENT_ID": "<agent-id>", "OWNER_ID": "<owner-id>", "PROXY_URL": "https://api.agentvalet.ai", "AGENT_PRIVATE_KEY_PATH": "/absolute/path/to/.agentvalet/agent.key" } } } }
What’s governed here
Nothing is allowed until you grant it. This is a typical first grant for Claude Code; you decide every row, and you can change it without touching the agent.
| What the agent tries | Platform | Decision |
|---|---|---|
| Read issues and pull requests | GitHub | Allowed within grant |
| Post a build summary in #eng | Slack | Allowed within grant |
| Merge a pull request | GitHub | Asks you |
| Change a DNS record | Cloudflare | Not granted |
Claude Code guide in the docsThe longer walkthrough, kept with the product docs.
Put Claude Code behind AgentValet.
Register the agent, grant only what it needs, and approve the risky calls from your phone. Free to start, no credit card.