Read-only by default
Cloud agents that never hold your keys hostage.
You authenticate as yourself and the secrets sit in your own vault, scoped to your workspace. Read-only until you say otherwise, revocable in one click, and never pooled with anyone else's.
read-only by default · revoke any time
✓ nothing pooled, nothing resold
✓ read-only until you allow writes
✓ one-click revoke
access · scoped to youread-only
🔒 claude · your oauth session yours
🔒 github · read repo read-only
🔒 aws · describe only read-only
> writes requestedneeds your approval
> credentials shared with other tenants — none.
Total visibility, zero blast radius.Nothing changes until you approve it.