Safe tool access for AI agents.
One MCP endpoint per tenant and actor, in front of vendor MCP servers, our own provider records and built-in tools. Credentials stay here, every call is checked against the actor's grants, risky calls wait for a person, and everything is logged with its cost.
- One MCP endpoint per tenant and actor
- Grants, caps and approvals on every call
- Credentials never reach the agent
- Licence-clean provider records
POST /v1/tenants/acme/actors/support-agent/tokens
Authorization: Bearer pdk_••••••••Short-lived, scoped to one actor. The agent never holds your app key.
Connections
Tenants connect once. Tokens never leave.
Your server creates a connect session and your tenant opens our hosted page: sign in at the provider, or paste a key. The token is encrypted here, refreshed before it expires, and revoked at the provider when a connection is deleted. Your app gets a connection id, never the credential.
- OAuth with PKCE and state
- API keys and basic auth
- Background refresh
- Encrypted at rest
- SSlackSign in at the provider
- GGitHubSign in at the provider
- RResendPaste a key
Your app gets a connection id. The token itself never leaves this service.
Guardrails
Grants per actor. Approval before risk.
Each actor sees only the tools it was granted, read live on every call. A daily cap backs it up. Calls you mark risky wait for a person; the approval is bound to exactly what the approver saw and is spent after one use. Every call is logged with its cost, and results come back marked as untrusted.
- Grants read live
- Daily caps
- Approvals bound to what was seen
- Untrusted-result marking
- Read messages, pages, issues Runs
- Send, create, refund Approval
- Delete anything Not granted
Three routes
Cheapest route first. Same rules on every one.
An agent's call reaches an app one of three ways, tried in order: the vendor's own MCP server, our provider record with its API operations as tools, or a built-in (web search, a page reader, Apify) with Composio as a paid fallback. Your agent calls one endpoint and doesn't know which route ran.
- Vendor MCP servers
- Provider records
- Built-ins and Composio
- 1. Vendor MCP serverGitHub's own MCP serveron your key
- 2. Provider recordOur Slack record, 38 operationson your key
- 3. Built-in or ComposioWeb search · page reader · Apifyper call
The same grants, caps, approvals and logs apply whichever route a call takes.
Provider records
A provider is data, not code.
One fixed OAuth engine, reviewed hard, and one JSON record per provider: where to authorize, how to refresh, which hosts are allowed, and the operations it exposes. Records are built from the provider's own docs, OpenAPI and official SDKs, proven by a live test, then published. Nothing is copied from Nango or n8n.
- Built from provider docs
- Proven by live tests
- Licence-clean
Evidence from the provider's docs, OpenAPI and official SDKs only. Nothing copied from Nango or n8n.
Three steps, one endpoint.
No SDK to embed and no model to run. Your server talks to our API; your agents talk MCP.
Your app gets a server key
Register once. Keys are shown once, stored only as a hash, and can be rotated without downtime.
Tenants connect their tools
Each of your tenants signs in to Slack, GitHub, Notion and more on our hosted page, or pastes a key. Credentials stay encrypted here.
Agents call one endpoint
A short-lived token per actor opens /mcp/<tenant>/<actor>: only granted tools, capped per day, approval before risky calls, every call logged with its cost.
https://programmable.dev/mcp/<tenant>/<actor>One plan per app. Pay for calls that ran.
A call counts when it reached the service. Refusals, calls waiting for approval and our own failures never count. Routes that run on your tenants' own keys are billed by those providers, not by us.
Trial
Each new app starts with 1,000 calls or 14 days, whichever comes first. No card needed. Everything works the same as on the plan.
Pro
$49 a month
- 25,000 billable calls a month included
- $2 per 1,000 calls over that
- Composio calls at Composio's price plus 20%
- Every tenant, actor, grant, approval and log
- Monthly; cancel any time in the billing portal
Prices in US dollars, before taxes. Billed through Stripe. See section 11 of the Terms.
Good questions, straight answers.
What is it, in one sentence?
A gateway that gives any app's AI agents safe access to outside tools through one MCP endpoint: credentials in one place, grants and caps per actor, approvals for risky calls, and a log of every call with its cost.
Does it call a model?
No. Your agents, prompts, memory and model calls stay in your app. Programmable Dev owns everything between “an agent wants to act in another app” and “the call happened, safely, and was logged”.
How do tenants connect their accounts?
Your server creates a connect session; the tenant opens our hosted page, signs in at the provider (OAuth) or pastes a key, and your app gets a connection id. The token itself is encrypted here and never returned to your app or the agent.
Which providers work?
Any app with its own MCP server, any provider we have a record for (built from the provider's own docs and OpenAPI, then proven by a live test), and built-ins like web search and a page reader. Records are published as they pass their live tests; the docs list what is live today.
Can an agent do something it shouldn't?
Each actor has grants, read live on every call; a daily cap; and approvals for the calls you mark risky, bound to exactly what the approver saw and spent after one use. Tool results come back marked as untrusted, so your app can treat them as data, not instructions.
Can I use it outside Programmable?
Yes. It runs on its own, with its own database and sign-in, and is sold on its own. The other Programmable apps use it the same way any customer does: through the app API.
Give your agents hands. Keep the keys.
Read the API contract, then write to us for an app key. We'll set you up with a tenant and your first connection.