Your agent's integration layer,
with guardrails built in.
Use with your existing AI personal assistant 🦞
Just add the new skill.md.
Works with the tools you already use
Guardrails in the code, not the prompt.
Every other guardrail can be bypassed by the agent. Corsair's can't — the permission layer is in the API, not the instructions.
Guardrails are instructions to the agent. A sufficiently motivated or confused agent can work around them.
Guardrails are permissions in the API layer. The action hits a hard stop. No instruction can override it.
How approval works
Your agent calls Gmail
"Send Sarah the Q1 numbers"
Corsair intercepts
Send action detected
Hard stop
Cannot proceed without approval
Review link sent
Expires in 10 minutes
You review the email
Looks right — tap Approve
Email is sent
When you approve
Your agent calls Gmail
"Send Sarah the Q1 numbers"
Corsair intercepts
Send action detected
Hard stop
Cannot proceed without approval
Review link sent
Expires in 10 minutes
You review the email
Looks right — tap Approve
Email is sent
When you approve
How it works.
When your agent calls a Corsair endpoint, four things happen.
Resolves the credential
The credential for that integration is fetched from the encrypted database. The agent never sees raw keys or tokens.
Checks the permission policy
Reads pass through immediately. Writes and destructive actions are evaluated against the configured mode for that integration.
Executes or pauses
Allowed actions run immediately and return typed results. Actions that require approval are held and a review link is sent to you.
Handles retries and errors
Rate limits, transient failures, and auth errors are handled automatically with configurable retry strategies.
Built for agent stacks.
Everything you need to give your agent safe access to the outside world.
Permission modes
Cautious, strict, open, or readonly — set per integration. GitHub strict, Slack cautious. Override individual endpoints as needed.
Encrypted credentials
Stored with envelope encryption. A KEK you control encrypts per-tenant data keys, which encrypt the actual secrets. Nothing leaves your database.
Review links
Risky actions are paused and sent to you as a review link. You approve or deny it, and your agent cannot get around it.
Multi-tenancy
Scope every call and credential to an individual tenant. Isolated credentials, data storage, and permission evaluation per tenant.
Webhook handlers
Typed, signature-verified webhook handlers ship alongside every API endpoint. React to real events — new PR, deal created, incoming email.
Plugin system
Any REST API works. Scaffold a full plugin — schemas, endpoints, webhook handlers, and key builder — with one command.
Pre-built integrations.
15 more in development. Need one that's not here? Ask your coding agent to build a Corsair plugin — any REST API works.
Permission modes.
Set GitHub to strict and Slack to cautious based on how much you trust each surface. Each integration gets its own mode.
cautiousrecommendedInstant
Instant
Approval required
strictInstant
Approval required
Blocked
openInstant
Instant
Instant
readonlyInstant
Blocked
Blocked
Override individual endpoints — lock down releases.create while keeping issues.create open.
Give your agent the keys. Keep the control.
Corsair is open source. Drop it into any agent stack and stop doing the work yourself because you're too scared to hand it off.