Your agent can ship the PR. It never sees the token.

You don't hand the agent the PAT. You unlock. The agent assumes a scoped, time-limited capability. The broker fires the call. The model never sees the key.

Connect an agent. Unlock. Assume a role. Request a capability. Docs

Hero workflows

Ship the PR

Read repo, open PR, merge with human approval. Token never enters Cursor.

Ops in Slack

Post and react without a bot token in MCP JSON.

Browser admin

SaaS console automation without cookie exfiltration.

How it works

Unlock

Human. Password + Secret Key. Emergency Kit once.

Assume

Agent proves identity. Requests a scoped, time-limited, revocable capability.

Execute

Broker injects the secret inside the executor. Calls the vendor. Redacts the result.

Revoke

Kill switch. Pin drops. Session expired.

Blast radius

Why not env vars.

If compromised	Blast radius
PAT in the `.env`	Full token until manual rotation
MCP env injection	Full token + often in logs and context
Assume capability	One scope, ~1h TTL, revocable without vendor rotation

Proof

No read_secret. Agents cannot fetch credentials.
Policy is deterministic. Deny wins.
Human approval on merge, delete, pay, exec.
Red-team security suite in tests/security/ - security model, not a certification badge.

Browser differentiator

Isolated Playwright executor. DOM, cookie, and storage protection.

Agents automate OAuth and admin consoles without harvesting session secrets into the prompt. Browser admin without cookie exfiltration.

Beside, not instead of

They	Assume
Password manager: a trusted human or app retrieves a secret	The agent never retrieves the secret
Secret store: a trusted workload reads a key	The broker injects inside the executor. No `read_secret`
MCP catalog: discovery of tools	Catalog is discovery. Broker is authority
Generic API proxy (stamp): forwards whatever the client sends to an allowed host	Messenger: named actions only. Deterministic policy. Human on merge, delete, pay, exec
Infisical Agent Proxy (stamp)	Assume (messenger) - action-level authz beside Infisical for K8s/CI
PAT in the `.env` or MCP JSON	Scoped capability. TTL. Revocable. MCP config: `ASSUME_URL` + `ASSUME_AGENT_ID` only

Operator

Unlock. Approve. Revoke. Sleep.

Hosted unlock keeps derived keys in RAM for the session. Opaque at rest. Not perfect zero-knowledge. Local path exists if you want keys off our machines.

Builders

MCP search → describe → execute - or run_action in one call for the happy path. The catalog is discovery. The broker is authority.

assume agent create + assume mcp install - signing key in OS keychain, not in MCP JSON.
Integration presets: connect GitHub or Slack in a few clicks (assume credential add --preset github).
Agent docs index: llms.txt for crawlers and LLM clients.

Engineering repo: assume. MCP id assume until rename is cheap.