Anlyon

npx add-mcp 'https://api.anlyon.com/mcp'

NewGovern the MCP tools your agents call

Let your agent act in your users' accounts

Each user connects their own HubSpot, Slack, Linear or GitHub. Your agent acts there under that user's limit and waits for their yes on risky steps. No token storage or approval backend to build.

Start building

Read the docs

A few lines on your server, then connect a user.

1. 1.ConnectEach user connects their own accounts. You store no tokens.
2. 2.GovernA limit and a yes for each user, checked before the call.
3. 3.ActYour agent acts in their account, and every write gets a receipt.

Your agent sets Anlyon up. It can't loosen its own limits.

Tightening applies at once. Raising a limit or switching off an approval waits for a person, in Slack, email or the console.

Works in Claude Code, Codex, Cursor, Gemini CLI.

Thousands of MCP servers, every tool on them. Your agent reaches only the tools you adopt.

Register a remote MCP server and Anlyon lists its tools and adopts none. Each tool you adopt gets approvals and receipts, and a tool that changes is refused until someone adopts it again. Your agent never holds the key.

Browse official MCP serversRead the announcement →

Official servers, published by the vendor itself

An agent in a customer's account can refund twice. With Anlyon, every write waits on that user's limit and their yes.

A chat in your app. A user asks the assistant to add a company to their CRM. The assistant needs their Attio, so the chat shows a Connect Attio button. The user pastes their own key into Anlyon's connect step; Anlyon holds the key and the model never sees it. The assistant searches, then creates the company, counted against a daily limit of 50 writes for this user. Deleting an old record waits for the user, who approves it in the chat, and the delete gets a receipt confirmed by Attio's read-back. Later the user asks for 60 more records: 47 fit under the limit, and the rest are refused before anything is sent.

An agent's mistake in a user's account is yours.

No OAuth to build

Send a user a connect link. Anlyon runs the consent, stores the token and refreshes it. Your app and the model never see it. If a user hasn't connected yet, the call returns a fresh link, so your app shows a Connect button.

• The consent page names your workspace, or shows your own OAuth app
• For API-key tools, each user gives their own key, checked with the provider
• Erase a user in one call: connections, limit counters and pending approvals

Read the guide

A limit and a yes for each user

Set one rule, such as 20 emails a day, and Anlyon counts it for each user before the call. A loop that goes wrong stops at that user's limit, not after it has emailed their whole contact list. For risky steps, the user approves the exact request in your app.

• Counted for each user, before anything is sent
• The user decides in your app, not in your team's inbox
• One switch halts every call in the environment

See approvals

Your server names the user. The model never does.

You pick the user on your server, with a key the model never sees. The model's tools have no user field, so a prompt can't switch users. Every call, approval and receipt carries the user's id, so you can show a user what their agent did.

• A key can refuse any call that names no user
• Filter calls, approvals and receipts by user
• Webhook and event payloads include the user

See access and audit

Your agent asks once. Anlyon checks the limit, waits for the yes and writes the receipt.

1. 01

   Your agent asks

   Your server names the user and the action, so a prompt can't switch users.

   invoke("add-note") · user_8f3k2

2. 02

   The limit is counted

   Counted against that user's limit before anything is sent. A loop stops there.

   limit 18 / 20 · ok

3. 03

   The user says yes

   A risky step waits until the user approves the exact request in your app.

   approval · approved by Maya

4. 04

   Anlyon makes the call

   With the user's own connection, which your app and the model never see.

   attio · add-note · sent

5. 05

   A receipt is written

   It names the user. Confirmed means it was read back from the provider.

   receipt · confirmed

The parts you'd otherwise build. Ready, and kept secure.

A connection for each user

A connect link per user. For API-key tools, each user gives their own key, checked with the provider and never returned.

A limit for each user

One rule, such as 20 notes a day, counted for each user before the call.

Approvals in your app

The user decides the exact request in your app, not in your team's inbox.

Receipts and audit

Filter calls, approvals and receipts by user. Webhook and event payloads include the user.

A halt switch

One switch halts every call in the environment.

Set up by your coding agent

Claude Code, Codex or Cursor runs npx @anlyonhq/cli init. Your rules live in anlyon.yaml, and loosening one waits for a person.

Start from the job. Three things an agent can do, with the key out of its hands.

All use cases

• Put your coding agent behind AnlyonClaude Code and Cursor work in GitHub and your database through named actions. A merge or a migration waits for a person, and every call leaves a receipt.
• Your AI product acts in each customer's own accountYour AI product acts in each user's own account, under that user's limit, waiting for that user's yes on risky steps, with a receipt that names them.
• Govern a remote MCP serverList a remote server's tools, see the risk of each one, and adopt only what you choose. A tool that changes is not called until you adopt it again.

Every write in a customer's account is a risk. Anlyon keeps it small and on record.

Less risk

A runaway loop stops at that user's limit, before the call. Risky steps wait for the user's yes, and the key never reaches the model.

Less cost

No token storage, refresh jobs, per-user counters or approval backend to build, host and keep secure.

Less effort

A few lines of server code, then send a user a connect link. Nothing to host.

Their tools. A brake on every write.

Your company's account, or each user's own. Every write runs under a limit and comes back with a receipt.

See every integration

Questions, answered plainly. The ones that decide whether this is worth an afternoon.

Anything still unanswered is worth an email.

support@anlyon.com

Email us

Because a working agent still gets bad input. One injected instruction or one retry loop can send the wrong email, refund an order twice or delete a record in a customer's account, and the customer holds you responsible. Anlyon stops the call at that user's limit, waits for the user's yes on risky steps, and keeps every key out of the agent.

Yes. Each user connects their account through a connect link, or gives their own key for an API-key integration. Your server names the user on every call, and Anlyon uses that user's connection. If the user has not connected yet, the call answers with a fresh connect link your app can show as a button.

No. Your server binds the user when it builds the client, with an API key that never reaches the model. The tools the model sees have no user field. A key can also be set to refuse any call that does not name a user.

A consent page that names your workspace, then the provider's own consent. With your own OAuth app, the provider shows your app's name and issues the tokens to it. Approvals show up wherever your app lists them, and the user decides there.

Because then the token is in the process the model is driving, and the only thing between a prompt injection and a sent email or a refund is your own code remembering to check. Route the call through Anlyon and the key never leaves our side, the user's limit and your rules run on every call, a person can be required, and one switch stops the environment sending anything further.

No. Anlyon is an API you call from code you already have. There is a TypeScript SDK and a Python SDK, or one command if you use Claude or Cursor. Replacing a direct HTTP call with an action invocation does not change how the rest of your agent is written.

Then use the local approval gate: an SDK wrapper that waits for a decision before your function runs. Be clear about what it is. Your process still executes the call with your credential, so it gives you the human decision and the record, not the credential isolation.

You can. For an agent that acts for your users, that means OAuth for each user with token storage, refresh and revocation, a limit counted per user, an approval flow your app can call, a record of every write, and a way to erase a user when they leave. That is weeks of work, and none of it is your product.

Yes. An impact limit caps the money your agents' governed actions move. Every agent, session and key in the environment draws from the same limit, reserved before dispatch. A new session or key does not get a new allowance. A limit can also count any unit you declare, such as emails or rows. Limits cover governed actions routed through Anlyon inside one environment, and an operator with the impact-limits:write scope can raise, lower or archive one.

Requests the cap covers stop with a 429 and the error code BUDGET_EXCEEDED. Never a silent drop, and never a surprise charge. The cap is on Anlyon operations, not on the money an approved action moves. During Early Beta Access nothing is charged at a limit. Paid plans arrive after the beta.

Your traces export as OpenTelemetry, so the audit record outlives any vendor, including this one. That is the part that is painful to lose, so it is the part we made portable.

Arcade connects your agent to your users' tools, and so does Composio, each from a catalogue of thousands of tools, by their own docs. Anlyon connects a shorter list and also controls what the agent does there, per user: a limit for each user, the user's own approval in your app, and a receipt for every write. If you need the long catalogue, use them, and you can run both.