Connect Gmail, Calendar, Slack and Drive once, or any of 1,300 MCP servers. Claude, ChatGPT, Cursor and anything else on MCP call them through one door — within limits you set. Sending, deleting and publishing wait for a card that expires in sixty seconds.
Every assistant speaks the same protocol to the same endpoint. The permission matrix is per assistant and per app: full, read-only, picked actions, or nothing. Read-only is never permission to send.
If it sends, deletes or publishes, you see the exact payload — not a summary — approve once, and it runs. No answer means deny. Replays are refused.
Every request, decision and effect is a record linked to the one before it. Export it and verify it offline; tampering breaks the chain at that point.
Set sends, deletes and reads per ten minutes. Turn blocking on and the call is refused rather than merely reported after the damage.
Full, read-only, picked actions, none. A tool that is not allowed is not listed and cannot be called — not hidden in a menu.
Turning an assistant off revokes its tokens immediately and writes the control event to the ledger. There is no grace window.
Streamable HTTP with OAuth 2.1 and PKCE, dynamic client registration, fifteen-minute access tokens. The same endpoint for every client.
Search the public MCP catalogue by brand: Notion, Linear, GitHub, Stripe, Sentry. Most need no sign-in; the rest take a token. Pick one, connect, set access.
Each assistant gets its own session: navigate, read the page with element refs, click, type, and take a screenshot that comes back as an image.
A six-digit code to your inbox, then a security notice when the account is created. No password is stored anywhere.
This is a preview build. The governance is real code with tests; the provider calls are demo-mode until OAuth client credentials are added. The page says which is which rather than blurring them.
The same endpoint works in Claude Code, Codex, Cursor, Claude and ChatGPT.