The open-source execution control layer for AI agents

Give agents access. Keep control of every action.

Conduit connects AI agents to your tools through one controlled path, where every requested action is checked before it reaches your systems.

The same refund tool can run a routine request automatically and pause a high-value one for approval.

Get early accessSee how Conduit works
How calls flowOne controlled path
  • Claude Code
  • Cursor
  • Codex
CONDUIT
  • checks policy
  • adds credentials
  • records result
  • GitHubGraphQL
  • LinearMCP
  • Postgrescustom
  • StripeOpenAPI
Every tool request passes through Conduit. Conduit checks the policy, attaches the credential, sends the request, and records the result.

/ Context efficiency

Your integrations grow. The prompt does not.

The model sees one Conduit tool instead of every connected tool at once. It searches the catalog, then loads only the instructions required for the action it wants to take.

Load one schema when needed, not the entire catalog on every turn.

Every schema loaded upfront2,000 tools
320,000tokens loaded every turn
Schemas loaded when needed1 tool
990tokens, every tool reachable
Every schema loaded upfront2,000 tools · ~320,000 tok
mergePullRequest()
listWorkflowRuns()
createRelease()
// + 682 more GitHub tools
createRefund()
listDisputes()
capturePayment()
// + 452 more Stripe tools
upsertLead()
runSoqlQuery()
convertOpportunity()
// + 317 more Salesforce tools
queryMetrics()
muteMonitor()
listIncidents()
// + 207 more Datadog tools
createIssue()
moveToCycle()
listProjects()
// + 112 more Linear tools
postMessage()
openModal()
listChannels()
// + 82 more Slack tools
appendBlock()
queryDatabase()
createPage()
// + 72 more Notion tools
query()
explain()
listTables()
// + 52 more Postgres tools
Schemas loaded when needed1 tool · ~990 tok
// the one tool the model ever loads: execute

Run agent-written code in Conduit's sandbox.
Tools are found, described, and called from
inside the code, one schema at a time:

  1. tools.search({ query })
  2. tools.describe.tool({ path })
  3. tools[path](input)

Nothing else enters the prompt until the
code asks for it.

323xless context, every tool still reachable

Estimates vary by schema size and tokenizer. This comparison uses the integrations selected above.

/ How it works

Every call follows the same controlled path.

Conduit checks the request, protects the credential, handles approvals, and records the outcome. The same controls apply across every connected agent.

  1. Approve the action, not the tool.

    Risk depends on what an agent is trying to do, not only which tool it selected. Conduit can check the amount, recipient, account, or any other input before the request reaches your system.

    Define simple rules in YAML, or use typed TypeScript when a decision depends on application logic.

    - tool: stripe.*.refund
  when: { input.amount: { gte: 5000 } }
  then: require_approval
  else: allow
    • Example policy based on refund amount
    • $4.00runs automatically
    • $40,000.00waits for approval
    • Same tool. Different request. Different decision.

  2. The secret and the sandbox never meet

    Agent-written code runs in an isolated QuickJS sandbox and calls a tool by name. Conduit resolves the credential outside that sandbox and attaches it only when sending the request. The agent can use the connection without ever receiving its secret. Not filtered out. Never there.

    Access without credential exposure.

    Never receives the credential

    • The model
    • The agent
    • Agent-written code
    • Sandbox memory

    Attaches the credential

    • Conduit, host-side, when it constructs the outbound request

  3. Approvals can wait. The work does not start over.

    When an action needs approval, Conduit saves the execution at that point. Approve it later, even after a restart, and the work continues without repeating calls that already succeeded.

    Completed results are saved and reused. Conduit continues from the first action that has not run.

    1. stripe.getChargecompleted, result saved
    2. postgres.querycompleted, result saved
    3. stripe.refundwaiting for approval
    4. slack.postMessagehas not run

    A paused run is just data.

  4. Know what ran, why it ran, and what happened next.

    Conduit records every requested action, the policy decision behind it, what the tool returned, and how long it took. Credentials are never stored in the trace, and sensitive values can be redacted before export.

    Debug the run. Audit the decision. Explain the outcome.

    conduit
    $ conduit tools search "refund a charge"
found 1 tool stripe.org.main.refund · require-approval ≥ $50
$ conduit trace show run_2f91
run_2f91 0.97s
stripe.org.main.getCharge 200 212ms
postgres.org.main.query 200 88ms
stripe.org.main.refund held: policy over threshold
$ conduit approvals list
1 held stripe.refund amount=$240 · policy: over threshold

  5. Connect once. Apply the same controls everywhere.

    Bring OpenAPI, GraphQL, MCP, and custom integrations into one catalog. Connected agents and Conduit clients all use the same policies, credential protections, approval flow, and execution history.

    Connect

    • OpenAPI
    • GraphQL
    • MCP
    • Custom JS
    One controlled catalog

    Use from

    • AI agents
    • CLI
    • Desktop
    • SDK

/ Why Conduit

Useful agents need real access.

Agents become useful when they can act, not only answer questions. But access should not mean exposing credentials or granting unlimited permission. Conduit gives every connected agent a controlled path to your systems, with consistent policies, approvals, and records.

Give agents enough access to be useful, with enough control to trust the result.

/ Deployment

Start locally. Expand when you need to.

Every deployment option is built around the same policies, credential boundary, execution model, and trace.

  • CLI

    Node 20+Available in early access

    Run Conduit as a background service from your terminal. Your integrations, credentials, policies, and traces stay on your machine.

  • Desktop

    Mac, Windows, LinuxPlanned

    Manage the same local service through a graphical console.

  • Cloud

    HostedPlanned

    Give local and cloud-hosted agents a managed Conduit endpoint without operating the gateway yourself.

  • Self-host

    DockerPlanned

    Run the complete server in one container backed by one SQLite file. No separate database, worker, or proxy required.

Questions

What exactly does Conduit do?

Conduit sits between AI agents and the tools they use. Every requested action passes through it, where policy is checked, credentials are attached outside agent-written code, approvals are handled, and the result is recorded.

Can an agent or model see my credentials?

No. Agent-written code calls a tool by name. Conduit resolves and attaches the credential outside the sandbox when it constructs the outbound request. The credential never enters the model, the agent, the generated code, or sandbox memory. Stored credentials are encrypted at rest.

How does Conduit decide whether an action can run?

Imported API semantics provide a starting point: a GET is not a DELETE, a GraphQL query is not a mutation, an MCP tool that declares itself destructive is taken at its word. You can then add rules that inspect the call's actual arguments, including amounts, recipients, accounts, or any other typed input. Any default can be overridden, because these heuristics are useful, not infallible.

What happens when an action needs approval?

Conduit saves the execution and its completed results. After approval, the run resumes without repeating calls that already succeeded, and paused executions survive a service restart. If an approval expires first, that fact lands in the trace like everything else.

What can I connect?

Conduit supports OpenAPI specifications, GraphQL endpoints, MCP servers, and custom JavaScript integrations. MCP-compatible agents, Claude Code, Cursor, and Codex among them, plus the Conduit CLI and SDK, can all use the same catalog.

Can I run Conduit on my own infrastructure?

Locally, yes. Conduit is MIT-licensed, and the early-access CLI runs on your machine. Dedicated self-hosting is planned, along with a hosted option for teams that do not want to operate the service themselves.

/ get early access

Give agents real access without giving up control.

Conduit is open source and in active development. Get early access to run it with your own tools and help shape the first release.

Product updates and early-access invitations only.