Controlled access for AI agents

Let agents act without handing them broad credentials.

Start with engineering work: coding tasks, GitHub changes, and MCP-connected tools. Keep using the agent loop your team trusts, or start a hosted ExecWarden session. Limit each tool, ask before selected calls, and inspect what happened afterward.

See a completed run See how it works

Agent

Hosted session

ExecWarden owns the agent loop

Client

MCP client

Client owns the agent loop

ExecWarden

Identity, per-tool grants, approvals, and an activity log.

Agent identityPer-tool grantsAsk modeActivity log

GitHub

Repos and branches

MCP tools

Selected tools

API actions

Named actions

Deploy targets

Selected environments

Execution is a separate choiceLimited hosted JavaScript and public HTTP where enabled, or customer-configured compute for shell, files, git, browser, and tests.

Inside the product

See the agent's access before the call runs.

Before a sensitive GitHub call, you can see the named Agent identity, its repository and branch-scoped grant, and the exact action waiting for approval. This approval example is separate from the completed run shown next.

ExecWarden Agent identity with a GitHub pull request grant limited to a selected repository and agent branches — Authority is attached per tool: this GitHub grant can create pull requests only for the selected repository and agent/* branches, in Ask mode.

ExecWarden approval request showing the exact GitHub pull request arguments and the Maintenance agent caller — Ask mode pauses the exact call before execution, with the caller, repository, branches, and title visible to the reviewer.

Hosted loop + connected computeJuly 24, 2026

Fix a seeded threshold bug and open a review PR.

ExecWarden hosted the agent loop and controlled GitHub access. Connected execution capacity supplied the repository, shell, and tests.

TaskFix the seeded threshold bug in the incident summary flow.

AccessSelected demo repository, `agent/*` branches, and no merge authority.

ExecutionConnected compute: failing test -> patch -> rerun tests.

Result2 passing tests and a review PR opened.

NoteThis run used pre-approved scoped grants. Other sensitive actions can be configured to pause for approval.

What changes in practice

Limit what each tool can reach, review exact calls, and keep provider credentials out of the agent environment.

These controls apply to tools supplied through ExecWarden. They do not control credentials or access independently present in a customer-configured execution environment.

Limit each tool

Choose exactly what the agent can reach.

Limit GitHub to selected repositories or branches, MCP to selected tools, and deploys to selected environments.

Review the call

Ask before the risky action executes.

Ask mode can pause the exact tool call and its arguments so a reviewer decides on that change, not on a vague request to continue.

Keep credentials contained

Give the agent a tool, not the provider credential.

When the agent uses a tool through ExecWarden, the underlying provider credential can stay out of its environment.

Where teams start

Start with coding work, MCP-connected tools, or execution close to private systems.

The first useful task should be concrete, limited, and easy to review afterward.

Autonomous coding agents

Branch-first coding work that lands in review.

Run bug fixes, CI investigations, maintenance, or dependency updates without giving the agent direct merge authority.

MCP clients

Control the tools behind the client your team already uses.

Codex CLI, Claude Code, and OpenCode can connect through MCP while provider credentials stay behind ExecWarden.

Execution near the work

Add a machine only when the task needs one.

Start lightweight, then connect customer-configured compute when the task needs files, commands, git, browser, or private-network access.

Who controls what

ExecWarden controls the tools it supplies. The execution environment controls what is already local.

That distinction matters. If a secret or tool is independently present in the machine, VM, or container, the agent can use it outside ExecWarden.

Controlled by ExecWarden

Tool calls routed through ExecWarden.

Agent identities, per-tool grants, approvals, provider results, revocation, and activity records apply to GitHub, MCP, package, and API calls routed through ExecWarden.

Controlled by the execution environment

What is already local to the machine or VM.

Files, shell commands, processes, network access, and secrets independently present in the environment stay under that environment's control.

Get started during beta

Start with one concrete task, then add access only when it earns trust.

Use the app during beta, or start in the docs and pick the first agent task you want to control.

Get started Choose a first task