Existing agents
Use Claude, Cursor, Codex, or another agent without sharing broad keys.
Create an Agent identity for the client your team already trusts. The agent discovers only the capabilities granted for this task.
Controlled access for agents working across your stack
Let agents use your systems without handing them the keys.
Connect tools and MCP servers, create an Agent identity, grant scoped authority, approve risky calls, inspect Activity evidence, and revoke or expire access when the task is done. Start with GitHub branch and PR work when code is the first system you want an agent to touch safely.
Cross-stack authority example
Let an incident agent read alerts, update the issue, inspect code, and ask before PR or Slack writes.
CallerIncident triage Agent identity
SourcesAlert MCP, issue package, GitHub, Slack
AllowedRead alert; inspect issue; clone repo
AskCreate issue, PR, merge, or post update
EvidenceActivity captures grant and approval path
ExpiresIdentity and grants expire after triage
Use cases
What can you safely let an agent do?
Use ExecWarden when an external agent or hosted session needs controlled access across GitHub, Google Workspace, remote MCP tools, internal APIs, support systems, or a sandboxed repo, but raw credentials and silent writes are not acceptable. Start with one bounded action, then expand once the audit trail and approval flow feel right.
GitHub repo work
Inspect a repo, patch in a sandbox, then review the branch or PR.
Grant one repo, one branch pattern, sandbox tools, and explicit PR authority so the agent can push a review branch, show tests, and keep merge separate.
Incident or support ops
Investigate across systems, propose one safe next action, then approve.
Read tickets, alerts, deploys, customer state, and runbooks; collect a ticket or reason; then execute the exact staged follow-up.
Production API package
Stage a mutation, collect a ticket, approve, then commit.
Wrap an internal endpoint as a capability package with package-local secrets, staged payload storage, human input, approval-shaped followup, and audit records.
Repeatable tasks
Run the same trusted task again.
Reuse the same authority for a manual, scheduled, or event-started workflow after a task has earned trust.
How it works
Start with one safe action, then make it repeatable.
Start by connecting one tool or MCP server, then expose one safe capability to an Agent identity. If the task needs a machine, run it in a hosted sandbox. When the same task becomes routine, run it again as a workflow with the same grants and approval gates.
Operating loop
1Connect tools and MCPBring GitHub, Google Workspace, internal APIs, remote MCP servers, or package-backed tools under workspace-owned credentials.
2Create an Agent identityGive Claude, Cursor, Codex, another MCP client, or a hosted session its own caller identity with expiry and revocation.
3Grant scoped authorityBind one capability to the caller, resource, arguments, capture mode, expiry, use limit, and approval mode the task needs.
4Approve exact callsPause risky actions, inspect the normalized payload, then approve or reject that queued call. GitHub branch/PR work is one concrete example.
5Inspect and revokeUse Activity to review caller, grant, policy decision, approval, provider result, and run evidence before widening, expiring, or revoking access.
1
Use the agent client you already trust
Put ExecWarden behind MCP so external agents can use real tools without seeing broad credentials.
2
Move to hosted execution when the task needs it
Sandboxes, files, browser, shell, git, previews, and resumable state make agent output inspectable when chat alone is not enough.
3
Reuse authority for repeatable tasks
When a task becomes routine, run it manually, on a schedule, or from supported events with the same grants, approvals, outputs, and evidence.
Operator flow
Let an incident cross tools without turning into broad access.
Start with alert context, update the issue, inspect the repo, then ask before a PR, merge, or team update. Use remote MCP connections or package-backed tools where they fit; the Agent identity, grant, approval, Activity, and expiry controls stay the same.
01
Sentry or alert source
Read the alert context, affected release, stack trace, and recent frequency.
02
Linear or support system
Create or update the issue only through a scoped MCP tool or package action.
03
GitHub
Inspect code, push a review branch, and keep PR writes or merge behind explicit approval.
04
Slack or review surface
Post progress or request a decision only when that write capability is granted.
05
Activity
Record the Agent identity, connector, grant, approval payload, provider result, and cleanup state.
Workflows
When an agent task works, make it repeatable.
A workflow is the repeatable version of a trusted task: the trigger that starts it, the capabilities it may use, the outputs it should produce, and the approvals it needs before changing anything important. For GitHub work, the trusted path is still branch first, PR review second, and explicit merge authority last.
- 1Define the repeatable job: objective, inputs, outputs, and capability grants.
- 2Run manually first, then add schedules or supported event sources only for workflows that have earned repeatability.
- 3Use GitHub webhook or GitHub App events for repo-triggered workflows; use declared package events for package-backed product events when the trigger is part of the focused job.
- 4Run agents or gateway capabilities with scoped authority.
- 5Pause for approval when a run crosses a sensitive boundary.
- 6Keep run records, transcripts, artifacts, decisions, Activity, and workflow state together.
Trust model
Know what the agent could do, did do, and who approved it.
Agents become useful when they can act. ExecWarden is built around the uncomfortable part of that sentence: deciding what they can touch, what must pause, and what evidence remains afterward.
Capability semantics
A grant is more than “tool allowed.” ExecWarden resolves the caller, capability, grant lifecycle, scope, policy attachments, and approval mode at invocation time. Current integrations add resource, argument, and approval checks where implemented: for example a Git push to refs/heads/agent/pr-142 on acme/api by the Codex repo-review key. The shipped transparent Git remote enforces repo and branch policy inline; GitHub REST tools check owner/repoarguments against the repo allowlist, Drive checks file ids, packages can enforce manifest-declared scope rules, and imported MCP tools use connection/tool grants plus schema-policy foundations where available. UI for selecting and hardening schema-policy attachments is still a focused follow-up, so unsupported schemas fall back to coarser controls. Approval-paused execution is used for normal gateway tool calls such as package writes, imported MCP writes, and configured GitHub actions. Canonical grants can be bounded by use count or expiry; Agent identities can carry their own expiry and can still be disabled or revoked when the job is done.
Scoped authority
Agents see capabilities, not raw keys
Issue bounded grants for one caller, workspace, capability, resource, argument shape, branch pattern, use count, or expiry instead of sharing broad credentials.
Approval gates
Risky actions stop at the boundary
Review sensitive writes, external changes, and scope expansion with the exact action arguments before the run continues.
Execution record
Useful work leaves evidence
Keep transcripts, tool calls, command output, grant decisions, approvals, provider results, artifacts, and Activity evidence in one place.
Bring your own control
Use external agents, hosted agents, or BYO compute
ExecWarden can sit behind MCP clients you already use, or provide the workbench when the agent needs an actual environment.
Next steps
Set up the first tool, then decide how much freedom the agent gets.
The docs walk through MCP setup, Agent identities, capability grants, package-backed tools, hosted agent sessions, workflow rules, and the approval points that keep risky actions visible.
Read walkthroughsSee repo, operations, and production API flows built from current platform paths.Read the guideConnect a capabilityWrap APIs, MCP tools, integrations, and custom packages in scoped access and approvals.Read the guideRepeat a taskReuse governed capabilities in manual, scheduled, or supported event-triggered workflow runs.Read the guide
Start with one safe action
Connect one tool, expire the identity, review one branch, then automate only what earns trust.
Open the console to connect accounts, create scoped Agent identities, set expiry, grant branch-limited GitHub access, review approvals, and keep Activity evidence in one place.