Grantlet

A local MCP credential broker for coding agents. Review each exact request in the desktop app, run approved provider operations, and keep long-lived secrets out of model context.

Start with a request See the boundary

macOS desktop app / MCP for Codex and Claude Code / typed provider operations

SubmitExact operation and target
ReviewProject, credential, effects, and risk
RunStarts after a short countdown you can cancel
ReturnBounded safe result

90+ typed operations

5 provider families, plus SSH hosts

3 s to cancel after you approve

0 secrets in agent-visible results

01 / How it works

The agent asks.
Grantlet decides.

Submit a typed request.

The agent picks a registered operation and names the exact project, credential, and target. A request never carries a secret.

Review it locally.

Grantlet Desktop shows the request code, targets, effects, credential, risk, and what will be returned. Nothing runs until you approve.

Grantlet starts the run.

After a short countdown you can cancel, the native authority admits one signed worker run on a short-lived credential made for that request. Agents cannot start it themselves.

Return safe results.

Secrets, signing headers, bearer tokens, cookies, and high-risk response bodies stay out of model-visible output. Every request leaves a signed audit record.

02 / Provider operations

Use credentials without delivering credentials.

Cloudflare actions stay provider-direct.

Deploy Workers and Pages sites, manage DNS, R2, D1, Secrets Store, and Email Routing through reviewed operations instead of shell-visible API tokens.

cloudflare.workers.scripts.deploy cloudflare.pages.deployments.create cloudflare.d1.migrations.apply cloudflare.dns.update

Every request runs on a credential made for it.

Connect each provider once and set a permission grid: the most any request may do. For each approved request Grantlet mints a short-lived credential with only the permissions that request needs, then revokes it.

GitHub App installation token AWS operator-role session Cloudflare scoped API token Google Cloud access token Twilio restricted API key

Secrets travel by handle, not by value.

Grantlet can generate a secret or mint a new key inside its worker and hand it to one reviewed destination: a Secrets Store entry, a Worker binding, an SSH env file, or a local program's environment. The agent only sees an opaque handle. Long-lived credentials carry a rotate-by date, and rotation deletes the old one only after every delivery succeeds.

secret.generateRandom cloudflare.tokens.issue cloudflare.secretsStore.putEntries local.command.execute

Workflow and secret changes face extra checks.

A proposal that changes GitHub workflow files opens a pull request from sealed files; you review the diff and approve with fresh macOS authentication, and agents cannot merge it. Environment secrets are written only when the environment requires reviewers and guarded branches, and you see any bypasses first.

github.workflows.verifyGuards github.workflows.propose github.environments.verifyProtection github.environments.secret.put

SSH hosts keep their own ceiling.

ssh.env.ensureEntries merges approved entries into a remote env file while preserving unrelated values and comments. Each enrolled host has a permission ceiling: reads and writes are on by default, while deleting and running commands stay off until you allow them.

+ API_URL + MAPS_BROWSER_KEY = existing comments = unrelated values

Repeat approvals stay bounded.

Approve once, or choose “Allow for this session” to cover identical requests: same operation, same target, same agent session. Grants expire, revoke in one click, and never cover raw provider requests, local commands, or file writes. Repeated secret delivery needs its own delivery grant with a use count.

standard · 4 h default high risk · 1 h default delivery · up to 20 uses, 8 h critical · never covered

MCP clients get the same boundary.

Grantlet Desktop adds itself to Codex and Claude Code and installs an agent skill that teaches the operations and rules. Codex connects over HTTPS to a local service that starts at login; Claude Code uses a stdio relay to the same service. You switch each project on or off for agents.

[mcp_servers.grantlet]
url = "https://127.0.0.1:17348/mcp"

03 / Security model

A local boundary built for agent workflows.

Grantlet reduces accidental credential exposure by moving provider auth, request approval, credential release, execution, and audit logging into a native macOS authority and a signed worker.

The authority verifies signed callers and binds each worker run to one approved request. Grantlet is pre-release: every capability is implemented and tested against simulated providers, while live-provider validation and packaged-install checks are still in progress.

The strongest local setup runs coding agents under a separate macOS user and connects them over HTTPS. A stdio client running as your own user is a weaker boundary.

MCP server: grantlet-mcp, stdio or HTTPS; agents use grantlet.requests.*
Authority: Native macOS authority owns approval, credential storage, and execution admission
Desktop: Request review, provider and SSH enrollment, project access, and signed audit export
Secrets: Held by the authority and released only to an admitted native worker
Worker: Signed native worker; one execution per approved request
Audit: Every request has a Grantlet request id and a signed, exportable record
Diagnostics: grantlet security doctor checks the local boundary

04 / Quickstart

Start local. Review each request.

Build the desktop app

npm install
npm run build:desktop

Check the setup

npm run mcp:status
npm run dev:grantlet -- security doctor

1 · Providers: Connect each provider in Grantlet Desktop and choose its permission grid.
2 · Projects: Register a project and switch it on for agents.
3 · MCP: Apply Grantlet to Codex or Claude Code; the agent skill is installed alongside.
4 · Request: Ask your agent for a change, review the request code in Desktop, approve, and watch it run.

Signed builds need an Apple Developer ID. Local development builds are ad-hoc signed, and grantlet security doctor reports them as not production-ready.

Give agents the narrow path.

Keep productive automation moving while Grantlet keeps secret material out of prompts, shell args, logs, and tool results.

Start with Grantlet