Give agents access. Keep control of every action.

1. 01

   Approve the action, not the tool.

   Risk depends on what an agent is trying to do, not only which tool it selected. Conduit can check the amount, recipient, account, or any other input before the request reaches your system.

   Define simple rules in YAML, or use typed TypeScript when a decision depends on application logic.

   - tool: stripe.*.refund
     when: { input.amount: { gte: 5000 } }
     then: require_approval
     else: allow

   • Example policy based on refund amount
   • $4.00→runs automatically
   • $40,000.00→waits for approval
   • Same tool. Different request. Different decision.
2. 02

   The secret and the sandbox never meet

   Agent-written code runs in an isolated QuickJS sandbox and calls a tool by name. Conduit resolves the credential outside that sandbox and attaches it only when sending the request. The agent can use the connection without ever receiving its secret. Not filtered out. Never there.

   Access without credential exposure.

   Never receives the credential

   • The model
   • The agent
   • Agent-written code
   • Sandbox memory

   Attaches the credential

   • Conduit, host-side, when it constructs the outbound request
3. 03

   Approvals can wait. The work does not start over.

   When an action needs approval, Conduit saves the execution at that point. Approve it later, even after a restart, and the work continues without repeating calls that already succeeded.

   Completed results are saved and reused. Conduit continues from the first action that has not run.

   1. stripe.getChargecompleted, result saved
   2. postgres.querycompleted, result saved
   3. stripe.refundwaiting for approval
   4. slack.postMessagehas not run

   A paused run is just data.

4. 04

   Know what ran, why it ran, and what happened next.

   Conduit records every requested action, the policy decision behind it, what the tool returned, and how long it took. Credentials are never stored in the trace, and sensitive values can be redacted before export.

   Debug the run. Audit the decision. Explain the outcome.

   conduit

   $ conduit tools search "refund a charge"
   found 1 tool stripe.org.main.refund · require-approval ≥ $50
   $ conduit trace show run_2f91
   run_2f91 0.97s
   stripe.org.main.getCharge 200 212ms
   postgres.org.main.query 200 88ms
   stripe.org.main.refund held: policy over threshold
   $ conduit approvals list
   1 held stripe.refund amount=$240 · policy: over threshold

   $ conduit tools search "refund a charge"

   found 1 tool stripe.org.main.refund · require-approval ≥ $50

   $ conduit trace show run_2f91

   run_2f910.97s

   stripe.getCharge200212ms

   postgres.query20088ms

   stripe.refundheldpolicy

   $ conduit approvals list

   1 held stripe.refund amount=$240 · policy: over threshold

   $

5. 05

   Connect once. Apply the same controls everywhere.

   Connect your MCP servers once. Every agent that reaches them, and every Conduit client, gets the same policies, the same credential protection, the same approval flow, and the same execution history.

   Connect

   • MCP servers

    

   One governed path

   Use from

   • AI agents
   • CLI
   • SDK

Load one schema when needed, not every connected tool on every turn.

mergePullRequest()
listWorkflowRuns()
createRelease()
// + 682 more GitHub tools
createRefund()
listDisputes()
capturePayment()
// + 452 more Stripe tools
upsertLead()
runSoqlQuery()
convertOpportunity()
// + 317 more Salesforce tools
queryMetrics()
muteMonitor()
listIncidents()
// + 207 more Datadog tools
createIssue()
moveToCycle()
listProjects()
// + 112 more Linear tools
postMessage()
openModal()
listChannels()
// + 82 more Slack tools
appendBlock()
queryDatabase()
createPage()
// + 72 more Notion tools
query()
explain()
listTables()
// + 52 more Postgres tools

// the one tool the model ever loads: execute

Run agent-written code in Conduit's sandbox.
Tools are found, described, and called from
inside the code, one schema at a time:

  1. tools.search({ query })
  2. tools.describe.tool({ path })
  3. tools[path](input)

Nothing else enters the prompt until the
code asks for it.