An all-in-one authorization fabric for the agentic era.
概览
Agents get scoped, revocable authority to act — never the secrets behind it. People keep their own credentials on their own devices. Websites get "Sign in with OpenSesame" without running a backend. Pre-release / early stage. APIs and behavior may change. An agent that needs to call GitHub, a database or a payment API normally gets handed a token, and from then on it has that token. OpenSesame inverts that. The agent holds a — a handle that names a connection but contains nothing secret — and states an . The Host authorizes the intent against policy and grants, performs the call itself, and returns a signed . There is no getSecret() anywhere in the agent-facing API, so there is nothing for a prompt injection to exfiltrate (ADR 0005). - The Identity API answers who; the Host API answers what they may do and does it. They are never merged behind one backend (ADR 0017).
README
以下为原文 README 节选，完整内容请查看原文。
OpenSesame
An authorization fabric for the agentic era. Agents get scoped, revocable authority to act — never the secrets behind it. People keep their own credentials on their own devices. Websites get “Sign in with OpenSesame” without running a backend.
Live app · Documentation · Getting started · Architecture · Decisions · Security
Status: Pre-release / early stage. APIs and behavior may change.
Project information
- Homepage: opensesame-labs.github.io/OpenSesame
- Install / getting started: docs/getting-started
- Configuration: docs/getting-started — environment variables follow
.env.schema - How to contribute: CONTRIBUTING.md
- Report a bug: GitHub Issues
- Report a vulnerability: SECURITY.md · open a private advisory
- Changelog: CHANGELOG.md
- License: MIT — LICENSE
The idea in one paragraph
An agent that needs to call GitHub, a database or a payment API normally gets
handed a token, and from then on it has that token. OpenSesame inverts that.
The agent holds a ConnectionRef — a handle that names a connection but
contains nothing secret — and states an intent. The Host authorizes the
intent against policy and grants, performs the call itself, and returns a
signed receipt. There is no getSecret() anywhere in the agent-facing API,
so there is nothing for a prompt injection to exfiltrate
(ADR 0005).
What it does
| For | OpenSesame provides |
|---|---|
| Agents | ConnectionRef + intent → authorize → invoke → receipt. Task-scoped grants that can only narrow, JIT access with approval, MCP servers and WebMCP tools, CLI credential helpers for git, Docker, AWS and kubectl. |
| Operators | An authority console: connectors, grants, approvals, device login, certificates (private CA, ACME), rotation, security alerting, audit receipts. |
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add tyler-r-kendrick/opensesame