Owyhee quickstart · free to start

Get started with Owyhee.

Put an agent under governance in minutes: sign in, add the agent, point your client at Owyhee, grant exactly what you allow — then watch the receipts, and revoke the moment you change your mind.

Open the console → What Owyhee is

What you need: an email address to sign in with, and an MCP-capable client or agent you want to govern — Claude, another MCP client, or an agent you're running from the deploy path. No credit card; Owyhee is free to start.

Six steps to a governed agent

Go to console.kipplelabs.com and sign in. Your first sign-in creates your workspace — nothing to install, nothing to pay.

Add an agent

Open Agents and choose Add agent. The default option — Owyhee holds the key — is the fastest: Owyhee mints the agent a verified AXIS identity, keeps its signing key in encrypted custody (the key is never shown to you or the agent), and reveals a show-once access token. Copy it right then — it isn't displayed again. Prefer to hold your own keys? Registering an existing identity is offered on the same screen.

Point your client at Owyhee

The console reveals a ready-to-paste configuration block for MCP clients along with the token — the endpoint has the shape console.kipplelabs.com/mcp/<server>. Paste it into your client's MCP settings and the agent's tool calls now travel through Owyhee. Running the deploy-path agent instead? The console shows the wiring for that too.

Connect tools and grant scopes

Add the tools and services the agent should reach under Connections — credentials go into Owyhee custody, not the agent's environment. Then grant the agent exactly the scopes it needs (say, content:comment on one site). Everything else is denied by default, with a reason, before it ever reaches the tool.

Watch the audit trail

Open Records. Every call the agent makes lands there as a signed record — which agent, under which verified identity and scope, what it did, and what it was allowed or denied. Filter it, drill into any row, keep it as evidence.

Revoke — and it stops

Pull a single grant, revoke the agent's token, or suspend the agent outright, all from the console. The next call stops cold. That's the point: access you can take back is access you can safely give.

What you just set up

Three things, and they're the whole product:

Custody

Keys and credentials live encrypted in per-organization custody inside Owyhee — never in an env var, never on the agent's box. The agent gets scoped access, not your secrets.

Permission

Per-agent grants, deny-by-default. A verified AXIS identity rides on every call, so a grant applies to exactly one agent — and revocation is one click.

Proof

A signed record of every action: who, what, under which scope, allowed or denied. Not a promise of good behavior — a receipt of actual behavior.

Ready?

The console is live and free to start. If you don't have an agent yet, the deploy path stands one up in about ten minutes.

Open the console → Deploy an agent