Everything your agent needs.
Nothing it shouldn’t have.

AgentBox is a governed workspace for AI agents: Git, model access, the tools, and an IDE attach, ready in five minutes. Every action runs under an identity delegated from you and bounded by what you are allowed to do — never your keys, and usually less than you.. Credentials never enter the workspace.

Set up in five minutes How the identity works

Open source · zero npm dependencies · no MCP required

runtime assertion · rt-42ed25519 · verified

human: dev@acme.com
agent: claude-code
team: payments
mode: build
task: jira:PAY-12
exp: 8h · revocable

decisions

Works with any agent, unmodified

Claude Code
Codex
Cursor
Copilot
Aider
your own

The gap

Every enterprise already runs agents on personal access tokens.

Developers hand their agents a PAT, an API key, a cloud profile — pasted into a local file, because that’s the only way the agent can work. The agent is now the developer, with no scope, no separate audit trail, and no off switch.

Enterprises solved this for humans years ago: directory groups, team ownership, change tickets, approvals. AgentBox brings that same machinery to agents — and keeps the secrets out of their reach entirely.

Agents authenticate as you: A PAT in .env or ~/.netrc makes the agent indistinguishable from the developer. The audit log says you did it.
Secrets live in local files: Every package script, generated snippet, and prompt-injected instruction can read the same files the agent reads.
Scope is all-or-nothing: A developer's token reaches every repo, branch, and API the developer can. The agent inherits all of it.
Revocation means rotation: Cutting off one agent means rotating a human's credential — and finding every place it was pasted.

The delegation principle

At most the developer. Usually less.

An agent’s authority is a subset of the human who issued it. Entitlements resolve from that person’s groups, teams, and tickets, so an agent can never be granted something its developer doesn’t have. Then the identity narrows it further.

Never more: Team membership comes from the developer's Okta or Entra groups, directory entry, and GitHub login. A Jira or ServiceNow elevation counts only if the ticket is assigned to that developer.
Usually less: Work mode (readonly · build · operate), a single task, and rules scoped to repository, ref, and operation cut the grant down to the job at hand.
Always separate: Its own identity in every audit record, its own approvals, and its own revocation — without touching the developer's credentials.

What dev@acme.com can do

teams: payments, platform · groups: engineering · owns: acme/payments, acme/billing · main via 2 reviewers

Agent rt-42 · claude-code

mode build · task PAY-12

✓push acme/payments refs/heads/agent/*
◷push acme/payments main — approval, 2 oidc
✕push acme/billing — not in this task
✕delete any ref · push tags
✕pr merge without a human

The inner box can never grow past the outer one. Revoking the agent leaves the developer untouched.

How it works

Issue an identity. Enforce it with the tools you already trust.

Developer
Issues a signed identity from the trusted host
Agent runtime
Presents it on every request — untrusted
AgentBox broker
Identity + entitlements + policy + approvals; holds every credential
Entitlement sources
Okta, Entra ID, directory exports, GitHub teams, Jira, ServiceNow
Providers
GitHub, GitLab, hosted agents, and model APIs today; AWS, Azure, K8s on the roadmap

Issue

A developer signs in to the issuer and mints an Ed25519 assertion: human (the login), agent, team, mode, task, expiry. It's bound to one workspace token by fingerprint.

Present

The agent sends it with every request. Nothing else changes — Git, the Anthropic SDK, and CLIs work unmodified.

Enforce

The broker compiles a capability envelope from your directory, teams, catalog, and tickets, then decides: allow, deny, or ask a human.

Prove

Every decision, with the verified identity and envelope, lands in a hash-chained audit log your SIEM can consume.

Designed for AI-native developers

One command to delegate. One file to govern.

Issue an identity to your agent the way your org would issue one to you. Write the rules once, in JSON, with requires clauses that read from the systems your security team already owns.

Identity bound to a workspace, expiring in hours
Rules gated on teams, groups, ownership, mode, and ticket
Fail-safe: source outages never widen access
Hot reload; a policy change supersedes open approvals

Read the identity guide ›

trusted host

# In the workspace: the token never leaves the machine, only its hash does.
$ agentgate fingerprint
{ "clientTokenSha256": "290dceb4…a20b1c" }

# Developers sign in to the issuer and mint their own identity; the human
# claim is the login. The same thing from the command line:
$ node scripts/issue-runtime.js --key issuer.pem --kid k1 \
    --client-token-sha256 290dceb4…a20b1c \
    --audience agentgate:acme \
    --runtime-id rt-42 \
    --human dev@acme.com --agent claude-code \
    --team payments --mode build \
    --task jira:PAY-12 --ttl 28800 \
    --out ~/.agentgate-runtime-assertion

# Revoke from the dashboard, or by jti or runtime in revocations.json;
# the broker picks it up within seconds.
{ "jtis": [], "runtimeIds": ["rt-42"] }

Integrations

Plugs into what governs your developers today.

Entitlement sources feed the decision. Providers are what the agent is allowed to reach. Both are adapters — GitHub is first because that’s where agents do the most damage.

See the roadmap ›

Entitlement sources

Okta groupsAvailable
Entra ID groups (Graph)Available
AD / Backstage exportsAvailable
GitHub teamsAvailable
Jira work itemsAvailable
ServiceNow change / incidentAvailable
PagerDuty incidentsRoadmap
GitLab groupsRoadmap

Providers

GitHub — Git, PRs, CI, LFSAvailable
GitLab — Git, MRs, pipelinesAvailable
Hosted agents — Copilot, CursorAvailable
Anthropic model APIAvailable
AWS KMS signingAvailable
AWS STS / workload identityRoadmap
Azure workload identityRoadmap
Kubernetes impersonationRoadmap

Security

Built by assuming the agent is hostile.

The agent, its commands, repository contents, package scripts, prompts, and issue text are all untrusted. We publish the threat model — including what AgentBox does not protect against.

cosign-signed imagesSPDX SBOMSLSA provenanceTrivy-gated releasesFuzzed protocol parser

Read the security model ›

No credential in the workspace: GitHub App keys, model API keys, and directory tokens live only in the broker — or the App key never leaves AWS KMS at all.
Fail closed, everywhere: Unknown actions, malformed protocol, audit write failures, expired policy, and entitlement source outages all deny.
Never more than the developer: The issuer refuses a team the developer doesn't hold, and the broker can re-check it on every request. An outage can't widen anything: allow rules need proof, deny and approval rules apply by default.
Approvals you can't replay: A grant covers the exact refs, object IDs, identity jti, and policy digest. Consumed once, durably, before forwarding.

Everything your agent needs.
Nothing it shouldn’t have.

Every enterprise already runs agents on personal access tokens.

At most the developer. Usually less.

Issue an identity. Enforce it with the tools you already trust.

Issue

Present

Enforce

Prove

One command to delegate. One file to govern.

Identity, authorization, and the enforcement to back it up.

Delegated identity

Enterprise entitlements

Task elevation

Human approvals

Brokered providers

Model API gateway

Scanning & egress

Tamper-evident audit

Plugs into what governs your developers today.

Built by assuming the agent is hostile.

Take the PAT out of your agent’s .env today.

Everything your agent needs.Nothing it shouldn’t have.

Every enterprise already runs agents on personal access tokens.

At most the developer. Usually less.

Issue an identity. Enforce it with the tools you already trust.

Issue

Present

Enforce

Prove

One command to delegate. One file to govern.

Identity, authorization, and the enforcement to back it up.

Delegated identity

Enterprise entitlements

Task elevation

Human approvals

Brokered providers

Model API gateway

Scanning & egress

Tamper-evident audit

Plugs into what governs your developers today.

Built by assuming the agent is hostile.

Take the PAT out of your agent’s .env today.

Everything your agent needs.
Nothing it shouldn’t have.