Agent loop
The client or runtime owns the loop; ExecWarden owns the mediated capability boundary.
Authorized client
Keep OAuth transport access visible and separately revocable.
Integration shape
The setup, credentials, governed actions, and evidence should be obvious.
Tools
Granted capabilities appear through MCP discovery and invocation.
Credentials
The client authenticates as an Agent identity with scoped access.
Governed actions
Tool discovery, invocation, approvals, expiry, and revocation follow the grants on that identity.
ExecWarden evidence
Mediated calls can appear in the activity log with related approval records.
Start
Create an Agent identity and configure the MCP client with its endpoint and credential.
One setup pattern
How this boundary works in practice.
The same boundary can apply whether the caller is Codex CLI, Claude Code, OpenCode, a hosted session, or another MCP-compatible client.
Identity
Name the MCP caller.
An Agent identity gives the client a revocable, inspectable source instead of a vague user token.
Discovery
Expose only granted tools.
The client discovers capabilities according to the scoped grants attached to that identity.
Policy
Use the same approval boundary.
Risky actions can pause for review no matter which compatible client initiated the call.
Examples
Example tasks and outcomes.
Get started during beta
Start with one bounded task and one boundary to review.
Use the app during beta, or open the docs and choose the first agent task you want to govern.