Local-first access broker for AI coding agents
Temporary access control for AI coding agents
Let Claude Code, Codex, Cursor, and Windsurf use GitHub, deploy tools, databases, and secrets through short-lived, scoped, auditable grants without exposing raw credentials.
Developers already searching for AI coding agent credentials usually branch into Claude Code permissions, Cursor .env exposure, and MCP tool access.
Built to validate AI coding agent security, Claude Code permissions, Codex agent security, Cursor security, MCP security gateway workflows, temporary credentials for AI agents, scoped access for AI agents, and audit AI agent actions.
$ agent-access scan Found 14 agent-reachable credentials: - .env.production - ~/.ssh/id_rsa - GitHub CLI auth - Firebase login - Vercel token - Postgres DATABASE_URL - Stripe live key $ agent-access run -- claude Session grant created: agent: claude-code workspace: acme/web ttl: 2h allowed: github.pr.create, vercel.preview.deploy, db.read.staging blocked: production deploy, stripe.live.write, ssh.prod $ agent-access revoke gl_7f3a
Problem
Your coding agent may already have more access than you think
.env files and ignored files are not a security boundary.
Shell access can expose SSH keys, GitHub auth, Firebase/Vercel tokens, database URLs, and Stripe keys.
Permission prompts create fatigue; bypass mode creates risk.
Existing secrets managers store credentials, but do not control what an agent does after access.
Solution
Give agents capabilities, not raw credentials
The MVP product shape is intentionally narrow: CLI, local server, and MCP gateway. It is a local agent permission firewall for developers who need useful automation without unlimited ambient secrets.
Agent receives a temporary grant, not the original credential.
Each grant has scope, TTL, allowed actions, resource boundaries, and optional approval.
Broker proxies or injects credentials only when needed.
Every action creates an audit receipt.
Revoke kills the grant without rotating the original key/token.
Audit receipt
agent: claude-code grant: gl_7f3a action: vercel.preview.deploy resource: acme/web result: allowed timestamp: 2026-06-16T10:24:00Z
Grant lease
Temporary token maps to a Grant Lease, not directly to the raw credential.
How it works
A brokered path between the agent and the sensitive tool
Run the scanner, create a grant, route the session through CLI or MCP, then revoke the lease when the task ends.
01
Scan local exposure
Find .env files, SSH keys, GitHub CLI auth, Firebase/Vercel tokens, DB URLs, Stripe keys, and MCP tools your agent can reach.
02
Create a temporary grant
Limit access by agent, workspace, service, action, resource, and TTL.
03
Run through CLI / MCP
Claude Code, Codex, Cursor, or Windsurf calls the local broker instead of reading raw secrets.
04
Audit and revoke
See what the agent did and revoke access without regenerating long-lived credentials.
MVP features
The first beta is CLI-native, local-first, and built around revocation
Local credential risk scanner
Local access broker server
CLI wrapper for agent sessions
MCP gateway for tools
Temporary grants with TTL
Multiple credential profiles per service
Action receipts and audit log
One-command revoke
Initial integrations: GitHub, shell/SSH, Firebase, Vercel, Postgres/database URLs, Stripe read-only/test mode
Use cases
The permissions developers actually need during vibe coding
Let Claude Code open a PR without giving it full GitHub access
Let Codex inspect Firebase logs without exposing your service account key
Let Cursor query staging Postgres read-only for 30 minutes
Let an agent deploy a Vercel preview, but not production
Let an agent read Stripe test data, but block live-mode writes
Security guides
Specific agent access risks developers are searching for
These guides map the broker model to common AI coding agent permission problems: Claude Code approvals, Cursor environment exposure, and MCP tool access.
Architecture
Local Agent Access Server sits between the coding agent and real credentials
AI Coding Agent
↓ CLI / HTTPS / MCP
Local Agent Access Server
├─ Agent Registry
├─ Grant Lease Manager
├─ Policy Engine
├─ Credential Vault
├─ Connector Plugins
└─ Audit Ledger
↓
GitHub / SSH / Firebase / Vercel / DB / Stripe
Temporary token maps to a Grant Lease, not directly to the raw credential.
The local server owns the dangerous boundary. Agents request capabilities over CLI, HTTPS, or MCP; the policy engine decides whether the connector may touch GitHub, shell/SSH, Firebase, Vercel, database URLs, Stripe, secrets for AI coding agents, or MCP tools.
Validate this with usComparison
Why scanner plus broker is different from storing secrets
| Model | Agent sees raw credential? | Temporary access? | Action-level audit? | Revoke without rotating original key? | Works with local coding agents? |
|---|---|---|---|---|---|
| Raw secrets in .env | Yes | No | No | No | Yes |
| Secrets manager only | Often | Partial | Credential access | Usually rotate | Partial |
| Sandbox only | Maybe blocked | No | Tool-level | No | Yes |
| Agent Access Broker | No by design | Yes | Action-level | Yes | Yes |
Private beta
Would you trust your coding agent with scoped access?
Help validate whether developers understand that an agent should not receive raw credentials, whether they will run a local risk scan, and which tools they most want to protect.
Primary conversion: waitlist_form_success.
Secondary conversions: cta_run_scan_click and beta_interest_click.
FAQ
The important boundaries
AI coding agent credentials are the tokens, SSH keys, cloud logins, database URLs, and tool grants an agent can reach while coding. Agent Access Broker is designed to replace raw credential exposure with temporary, scoped access for each session.