GautamTalksDev/counterseal

Every irreversible action gets a second seal.
**Your AI agent never holds a real API key, and anything it cannot take back waits for your passkey.**
Website · Quickstart · How it works · Limits · Security · Self-hosting · Full guide
Illustrated flow: the repository name is an example. The 428 response, the rule id and the approve link are what the server returns.
Quickstart
Three commands (the CLI is the counterseal package, Node 20 or later, zero dependencies):
Prefer no terminal? Create an account at /app (a name and a passkey) and press
**Try a held call**: a pretend call you approve with your passkey (nothing real is called and nothing is made public).
Then connect your agent.
---
Why: no approval, no key
In April 2026, an AI coding agent hunting for a staging credential found a Railway API token in an unrelated file and
called volumeDelete. PocketOS had its production database and the backups on the same volume deleted in nine seconds.
The token had been made to manage custom domains, and the prompt-level guardrails were on.
(AI Incident Database)
A prompt is not a permission system. Counterseal moves the decision out of the model:
- The agent holds a scoped proxy token (lsh_...), never the real key. The real key stays in an encrypted vault and is
added to the request on the server.
- A call that cannot be undone (a delete, a force push, a refund, a DROP TABLE) is held until a human approves that
exact request with a passkey. No approval, no key.
- The decision is written down. With receipts on, each decision on a write is also an entry in a public log that anyone
can check.
The agent's signed request is the seal. Your passkey approval is the counterseal. The public log keeps the impression.
Connect your agent
After the three commands in the quickstart, give the token to your agent as an MCP server (the leash_request tool calls the APIs through Counterseal):
Or point any SDK at https://counterseal.gautamkhosla.com/p/github with the token as its bearer. When the agent tries
something irreversible it gets 428 held_for_approval and an approve link, and your phone or browser asks for a passkey.
All commands: login, logout, add, creds, tokens, token, revoke, freeze, holds, watch, agent-key,
agent-keys, mcp, mcp wrap|pin|unpin|status, guard install|uninstall|status|check|map. Run npx counterseal help.
Features
| | What it does |
|---|---|
| **Approve** | Irreversible calls are held until a passkey approves them, on your phone or laptop. An approval covers that exact request, once, within 10 minutes. |
| **Record** | With receipts on, every decision the broker makes on a write (allowed, held, approved, executed, denied) becomes an entry in a public, append-only Merkle log (RFC 6962, signed checkpoints). Allowed reads are not recorded. A receipt holds the method, the provider host, the decision and the rule, never a path, body, key, token, name, email or IP. Verify in the browser or offline with sdk/receipts.mjs. |
| **Prove who** | Bind a token to an agent key (Ed25519). It then only works on requests that key signed (RFC 9421), so a stolen token alone does nothing. |
| **Guard** | counterseal guard is a hook for a coding agent's shell commands. A command on the shell map (29 rules: terraform destroy, git push --force, DROP TABLE through psql, rm -rf outside the project, and more) waits for your passkey. A seatbelt, not a sandbox. |
| **MCP gateway** | counterseal mcp wrap sits in front of any local MCP server: destructive tool calls wait for your passkey, and the server's tool definitions are pinned so a changed tool is hidden until you review it. |