AgentValet is a broker. It sits in the call path between your agents and the real systems they reach. Each agent gets a scoped identity (it can only call what you granted, nothing else). Risky calls wait for approval-as-policy (a human okays the action before it runs). Every action leaves a receipt you can hand an auditor.
Govern the agents you already run, wherever they run. No new runtime to adopt, no sandbox to migrate onto.
Free tier, no card. Live in 5 minutes, or we'll wire your first agent with you on a call.
"Dharmesh Shah, co-founder and CTO of HubSpot, described a valet key for AI agents: one that starts the car but won't open the boot or the front gate. I commented that I might build it. Then I did. I write the code, run it in production, and I've spent fifteen years in regulated Australian environments where a leaked credential is a genuinely bad day."
The agent inherits your raw API keys. It can read your email, write to your database, push to production, spend money, and delete files. None of that was intentional. It's just what "give the agent access" looks like with no governance in between.
Each agent has its own RS256 identity (a signing key that proves which agent is calling), granted only the scopes it actually needs. Risky calls pause for a human. Every action writes an append-only receipt. Revoke one agent in a click and nothing else is touched.
A walkthrough of the real decision path: policy, scope, approval, vault, proxy, audit. Flip the switch in the demo header to compromise the agent, then watch the same six gates stop it before a credential is ever issued.
Interactive. Starts when it scrolls into view. Toggle legitimate / malicious, or pause it.
npx @agentvalet/register. An RS256 keypair is generated (a private signing key plus a public one we can check it against). The public key goes to the registry, the private key never leaves your machine.Each one is a real control in the product, not a diagram. Every one of them works on the day you sign up.
Bring your own key. It stays on your machine, travels with each call, and is never vaulted or written down on our side. Your agent's calls relay through AgentValet and land in a live audit feed on a private link. Observe Mode applies no policy: it records what your agents do and blocks nothing, so it is a recording of real calls, not a safety net. We keep call metadata (platform, endpoint, method, status, timing) for 24 hours and then delete it, and we never keep your key, your request bodies, or the responses. No account is needed to start. When you're ready for full governance, sign in once and the trail comes with you.
One broker in front of everything your agents touch, so there's a single audit trail and a single place to pull the plug.
Point AgentValet at any third-party MCP server (the open standard agents use to reach tools) and it becomes a governed platform: the token is vaulted, the server's tools become scopes you grant per agent, and every call runs the same approval and audit path. No token on disk, no token in your config. AgentValet also runs its own hosted MCP server over OAuth 2.1.
The assumption underlying most secrets management is that if nobody can read the secret file, you're fine. That breaks the moment an agent runs with inherited API keys and no scope enforcement, because now a compromised agent or a careless scope grant becomes a master key.
AgentValet starts from a different position. Each credential gets its own AES-256 data encryption key, and that key is itself encrypted by a per-organisation master key, held on paid plans in tamper-resistant hardware that will not hand it back out. When a call comes in, the broker unseals the credential in memory for that one request and discards it. It never lands in a log, a response body, or a debug trace, and it never reaches the agent.
Scope enforcement runs first, before anything is unsealed. An agent without the right grant never gets that far. Risky actions pause for a human. Every decision, approved or denied, lands in the append-only audit log (rows can be added, never rewritten). Revoke an agent and the effect is immediate.
Not sure where your own gaps are? The Agent Exposure Scorecard maps your setup to the OWASP Top 10 for Agentic Applications 2026 in about two minutes, and shows your score with no email.
One MCP endpoint (a single address your agent host already knows how to talk to). Connect it in minutes, or register directly with npx @agentvalet/register. Nothing about your stack changes: same models, same frameworks, same agents. They just call through the broker instead of holding the keys.
A LangChain tool, a cron job, a plain Node or Python service: anything that isn't an MCP host talks to the broker through the client library instead. Same grants, same approvals, same audit log. The only credential on the machine is your agent's own identity key.
import { AgentValet } from "@agentvalet/client"; const av = AgentValet.fromEnv(); await av.call({ platform: "slack", endpoint: "/api/chat.postMessage", method: "POST", scope: "chat:write", data: { channel: "#general", text: "Deploy finished." }, }); // No Slack token in this file, this process, or the model's context. // Checked against your grants, credential injected at call time, // one audit row written.
And the part a diagram can't show you: what happens when the agent reaches for something you never granted. A denial is a typed error your code can branch on, not a stack trace.
import { AccessDeniedError } from "@agentvalet/client"; try { await av.call({ platform: "stripe", endpoint: "/v1/refunds", method: "POST", scope: "refunds:write", data: { charge } }); } catch (err) { if (err instanceof AccessDeniedError) { // Not a crash. A governance decision your code can act on. const decision = await av.requestAccess({ platform: err.platform, scope: err.scope, reason: "Refund duplicate charges flagged by support", }); } }
from agentvalet import AgentValet av = AgentValet.from_env() av.call( platform="slack", endpoint="/api/chat.postMessage", method="POST", scope="chat:write", data={"channel": "#general", "text": "Deploy finished."}, ) # No Slack token in this file, this process, or the model's context. # Checked against your grants, credential injected at call time, # one audit row written.
And the part a diagram can't show you: what happens when the agent reaches for something you never granted. A denial is a typed exception your code can branch on, not a stack trace.
from agentvalet import AccessDeniedError try: av.call(platform="stripe", endpoint="/v1/refunds", method="POST", scope="refunds:write", data={"charge": charge_id}) except AccessDeniedError as err: # Not a crash. A governance decision your code can act on. decision = av.request_access( platform=err.platform, scope=err.scope, reason="Refund duplicate charges flagged by support", )
Things you can actually verify, not things I'm asking you to take my word for.
Published on npm. Works today. Free tier, no card required.
Every action through AgentValet writes a receipt you can export. If you ever find an agent action that isn't in your audit trail, that's on us: a full refund, and I'll help you move off. Check it free before you trust me.
It's still beta, and I'll tell you what isn't built yet rather than paper over it. Bring-your-own-key is in development. A handful of integrations are in testing, not yet live. If you need something specific, ask me directly.
You pay for the calls your agents make, not for seats, not per agent. Register as many agents as you like on any plan. A quiet month costs less, and governance never becomes the reason you don't put an agent behind it. AgentValet is in beta: any plan you start now is locked in for as long as you stay subscribed.
Go past your plan's included calls and the work keeps running. Nothing is cut off mid-workflow, and your dashboard shows where you stand before the bill does.
Priced on what you actually run, agreed up front. Okta SSO live today, forensic audit (IP, geo, request ID on every action), per-user connection identity (the downstream system logs the person, not one shared bot), and the controls your security team will ask for before agents touch production. Run a scoped pilot with your real agents. If it doesn't satisfy your team, walk away.
The broker runs in ours, as a managed service, so there's nothing for your team to install or patch. The part that touches your machines is open source under MIT (the MCP server, the CLI, the desktop bundle, and the runtime adapters), so you can read it, fork it, and run it yourself. Your agents stay exactly where they are; only the outbound call path changes. Enterprise customers can ask for a dedicated managed tenant in a specific region.
Four things, in order. It's deny-by-default (an agent can call nothing until you grant a specific scope). Three layers then have to agree on that call: your org guardrails, the owner's policy, and the agent's own grant. Anything risky hits approval-as-policy (it stops and waits for a human to okay it). And it's a keyless bind (the agent never holds the credential), so even a fully compromised agent has nothing to steal and nothing to reuse somewhere we can't see.
Yes, and you don't move anything to make it work. AgentValet is model-agnostic and framework-agnostic: it governs the call to the real system, not the model that decided to make it. It's MCP-native (it speaks the open protocol your agent host already uses for tools), so Claude Code, Cursor, Codex, Claude Desktop and others connect by adding one endpoint. Anything that can make an HTTP request and sign a short-lived token can use it, including code you wrote yourself.
Every call writes one row at the moment it's decided: timestamp, owner, agent, platform, action, the outcome, the reason, and the exact policy version that produced it. The table is append-only at the database level (the application holds INSERT rights and nothing else, so no product path can rewrite history). That gives an auditor a complete, ordered decision record they can reconstruct a session from, exportable to CSV, JSON, or PDF on Team and up. It's a decision record rather than a packet capture (it proves what was decided and which rule decided it, without keeping the contents of each request).
The governance itself is free. On the Free plan you get per-agent identity, deny-by-default scopes, human approval, keyless bind, and the audit log, on a real agent, with no card. Observe Mode (a recording of what your agents already do, with no policy applied and nothing blocked) is free too, and doesn't need an account. Paid plans are priced on what you actually run: more call volume, longer audit retention, export, push approvals, delegated approvers, and the multi-user and forensic controls a security team asks for.
An API key is a static secret that can't prove who is holding it. AgentValet gives each agent an RS256 keypair instead (a private signing key that never leaves its machine), so every request is attributable to one named agent. Scope enforcement, approval, and the audit trail sit on top of that identity. Revoking one agent doesn't mean rotating a key across every system it ever touched.
Revocation is immediate and cascading. The public key leaves the registry, every scope grant is invalidated, in-flight requests are rejected rather than drained, and the stored OAuth refresh-token chain is revoked upstream so the access can't be quietly resumed. Nothing else in your org is touched.
Start on the free tier and run your first agent through it. You'll know within an hour. If the audit trail and approval flow don't satisfy your team, walk away.