grant --for 4h
Scoped, expiring passes
Name the routed tools an agent can reach. Everything else is denied, and the lease expires on its own.
A pass for your agents. Not your keys.
Switchboard is a local authority and routing layer for AI coding agents. It pulls the MCP servers your agents already use into one routed place, keeps secrets in your OS keychain, and puts each agent on a scoped pass that expires on its own.
npm install -g @switchboard-mcp/cli
Works with the coding agents you already use
Claude Code
Codex
Cursor
MCP
01 / 04
the loop
Four checkpoints between intent and infrastructure.
Start in the repo where your agents already work. Switchboard finds current routes, writes value-free secret references, closes supported bypasses, grants a bounded pass, and keeps the result inspectable.
$ switchboard scan high claude:github · token in plaintext med claude:linear · direct route $ switchboard import --write --cleanup-client ✓ routes consolidated · backups written next: switchboard secrets set github/acme_app/dev/token next: switchboard install claude --write
$ switchboard secrets set github/acme_app/dev/token ✓ stored in OS keychain $ switchboard install claude --write ✓ project route installed $ switchboard grant --profiles github_acme_app --for 4h ✓ PASS GRANTED fix-ci github_acme_app_* allowed linear_* denied everything else denied · expires in 4h
claude → linear_create_issue ✕ DENIED out of scope routed call stopped before the provider decision appended to the audit chain
$ switchboard audit verify scanning 1,204 entries... ✓ Chain: OK
Switchboard capabilities
approval gate
Human gates where they matter
Hold selected calls for a human decision without widening the rest of the pass.
audit verify
Tamper-evident local audit
Every routed call, denial, and approval is hash-chained JSONL that you can verify offline.
for agents
Give the setup to the agent already in the repo.
Copy the guarded setup prompt, or mount the packaged docs MCP so an agent can inspect the product before it changes anything.
claude mcp add switchboard-docs -- npx -y @switchboard-mcp/docs-mcp
Set up Switchboard in this repo. It puts the agent on a scoped, expiring pass instead of raw keys. Reference https://github.com/wkoverfield/switchboard/blob/main/llms.txt or mount the docs MCP with npx -y @switchboard-mcp/docs-mcp. 1. Install the CLI: npm install -g @switchboard-mcp/cli 2. Run `switchboard scan` and show me what Claude Code and Codex can already reach here. 3. Run `switchboard import --dry-run`, walk me through the plan, then run `switchboard import --write --cleanup-client`. 4. For each secretRef that import prints, give me the exact `switchboard secrets set <ref>` command to run myself. Never read or handle the token value. 5. Route every cleaned client that should remain usable through Switchboard. Run `switchboard install claude --write` for Claude Code and `switchboard install codex --write` for Codex, as applicable. 6. Ask how long the pass should last, then run `switchboard grant --for <duration>`. 7. Verify with `switchboard status` and `switchboard doctor`, then report what is allowed, approval-gated, and denied.
02 / 04
secrets
Token values leave config. Your config keeps a name.
Import rewrites supported client routes around a value-free secretRef without reading the token. You store the value separately with the exact switchboard secrets set command it prints.
"env": {
"GITHUB_TOKEN":
"ghp_R8xK2pLm4Uf9...live"
}
env:
GITHUB_TOKEN:
secretRef: github/acme_app/dev/token
After secrets set, the configured value lives in your OS keychain and is resolved into the server that declared it at launch. Exact rollback backups preserve the client config that existed before import, including any plaintext already present.
03 / 04
security
Honest about its edges, and written down.
Switchboard governs paths routed through it. Raw shell, provider CLIs, and direct MCP routes can bypass it, and scan reports those paths. Strict mode makes an unbound routed connection deny by default.
Threat model
A STRIDE analysis of every surface: what enforcement binds, what it cannot, revocation semantics, and accepted risks.
Delegation that cannot widen
A lead agent can hand narrower passes to subagents. Children are validated as strict subsets of their parent.
A chain you can inspect
Per-entry hashes, sequence numbers, and an out-of-band head marker make edits and tail truncation loud.
Local read-only dashboard
Live passes, pending approvals, and the recent audit stream stay on the machine where Switchboard runs.
04 / 04
what's next
Single-machine today. Team controls later.
The local product stays free and useful without an account. The org model and enterprise surface remain roadmap work after the single-developer path is proven.
Shared policy
Multi-user identity
SIEM export
External audit anchoring