Skip to content
Anlyon
Esc
↑↓navigate↵open⌘Jpreview
On this page

Put your coding agent behind Anlyon

Point Claude Code or Cursor at Anlyon instead of directly at an MCP server, and get approvals and receipts on what it does. No app to build and no end users.

A coding agent connected straight to an MCP server holds your token and can call every tool on it, with nothing between a wrong call and your production data. Put Anlyon in between. The agent connects to Anlyon alone, Anlyon holds the credential, and each call goes through your approvals and leaves a receipt.

There is no app to build and no end users. The calls use your own connection.

This only works if the agent has no other way to reach the server. Step 5 is the step that makes the rest count.

How it cuts risk and effort

  • A wrong call waits for you. A tool that needs approval sends nothing until a person decides, and that decision is bound to the exact request.
  • The agent sees only what you adopted. A tool you did not adopt is not offered through Anlyon, and one that changes after you reviewed it stops working until you adopt it again.
  • The token leaves the agent’s reach. Anlyon adds it when the call goes out.
  • You get a record. Each call leaves a receipt you can read later, in one place across every server.
  • One command sets it up. Your agent can do most of it. You make the decisions.

1. Point your agent at Anlyon

In your project:

npx @anlyonhq/cli setup claude-code
npx @anlyonhq/cli setup cursor

This adds the anlyon server to .mcp.json or .cursor/mcp.json. The file holds a URL and no secret, so it is safe to commit. It also lists the servers your agent can still reach directly, with the command to remove each one. Keep that list for step 5.

Then sign in from your agent, which opens a browser:

  • Claude Code: run /mcp, choose anlyon and authenticate.
  • Cursor: open Settings, then MCP, and connect anlyon.

Keep the key anlyon in the config. Hosts prefix a tool’s name with its server’s key and limit the total, and Anlyon fits its tool names to that key.

2. Register the server

Log in, then give the CLI the server’s address. Your agent can run these too.

npx @anlyonhq/cli auth login
npx @anlyonhq/cli mcp add https://mcp.example.com/mcp --header "Authorization: Bearer {{secret:EXAMPLE}}"

Fill in the command by how the server signs you in:

The server takes Do this
A token Store it in the console’s Secrets, give it an allowed host that matches the server, and pass --header "Authorization: Bearer {{secret:NAME}}". Naming a secret needs the secrets:read scope. A person signs that off before the token is sent.
An OAuth sign-in Pass --oauth, with --client-id if you registered a client with the vendor. A person signs that off, then connects an account on the server’s page in the console.
Nothing Pass only the URL.

The address comes from the vendor’s documentation.

Only remote servers using MCP’s Streamable HTTP transport can go behind Anlyon. A server your agent starts as a local process cannot.

3. Choose the tools and sign them off

npx @anlyonhq/cli mcp tools example
npx @anlyonhq/cli mcp adopt example list_issues delete_issue

adopt prints a link and exits 15. A workspace admin opens it, reads each tool’s definition, and approves or rejects. Nothing your agent holds can approve it, including a key or a login with every scope. That is the point: an agent cannot widen what it may do. See Sign-offs.

The class shown for a tool is a suggestion from what the server says, and server text is untrusted, so read what a tool does before you adopt it. By default, a tool suggested as irreversible or destructive waits for approval on every call. To gate everything, pass --approval all.

4. See the tools in your agent

Each adopted tool appears as action_<server>-<tool>, for example action_example-list_issues. A very long name is shortened to fit what hosts accept, and ends in a short hash.

Anlyon’s list updates within 30 seconds, but a host may keep the list it read when it connected. If a new tool does not appear, reconnect: run /mcp in Claude Code, or toggle the server in Cursor’s settings. Until then the agent can use invoke_action with the action’s name.

5. Remove the direct route

An agent that can still reach the server directly bypasses Anlyon. No approval or receipt applies to that call. Anlyon cannot see it and cannot stop it. So:

  1. Remove the server from your agent’s config. anlyon setup lists what it finds in the project’s config and your user config, with the command for each. Check for anything else your host loads, such as plugins or extensions.
  2. Remove the credential from the agent’s reach. Take the token out of the config, .env files and the shell environment your agent runs in. Better, revoke it and create a new one that Anlyon alone holds. A token the agent can read is a token it can use from a script, whatever its MCP config says.
  3. Check other routes. A vendor’s CLI that is already signed in on your machine, such as gh, is a direct route too. Sign it out, or use your host’s permission settings to stop your agent running it.

Run anlyon setup claude-code or anlyon setup cursor again to check the list is empty. It reads MCP config only, so it cannot see a token or a CLI login elsewhere on your machine.

What a gated call looks like

  1. Your agent calls the tool. Nothing is sent. It gets back Awaiting human approval and an approval id, and should tell you it is waiting.
  2. You decide in the console under Approvals, or in Slack. Anlyon asks someone other than you when it can: you decide your own agent’s request only when nobody else in the environment can.
  3. Your agent calls wait_for_approval, which waits up to 45 seconds by default and answers pending if you have not decided. It calls again.
  4. Once you approve, the exact request goes out by itself, and wait_for_approval returns the outcome as invocation. If you deny, or the approval expires, nothing is ever sent.

A host can put its own limit on how long one tool call may run. Asking for more than the default with timeoutSeconds (up to 120) can run into it, and then the call fails while the approval stays open. The approval is not lost: your agent can call check_approval with the same id.

What this does not do

  • It governs calls that go through Anlyon, and only those. See step 5.
  • Remote servers only. Streamable HTTP over https. No stdio.
  • Receipts grade acknowledged. The server answered. Anlyon does not read the change back, so these never grade confirmed. See Receipts and grades.
  • The suggested class is a suggestion. It comes from what the server says about itself.
  • Some tools are loosely checked. Anlyon checks each call’s input against the tool’s JSON Schema. A tool whose schema it cannot check in full, such as one that points to another file, is still adopted, marked Loosely checked: its arguments only have to be a JSON object, and approval is suggested for it. See How a tool’s input is checked.
  • Your agent can still do damage through what you adopt. A tool you adopted without approval runs without asking. Use approvals for anything that writes.

Fix what you will meet

What you see Why What to do
Exit 15 from anlyon mcp adopt A person has to approve it Open the link it printed
A new tool does not appear The host kept the list it read at connection Reconnect the server
Unknown action tool The tool was disabled, archived or not adopted Run anlyon mcp tools <name>
Tool result naming tool_changed The server changed the tool after you adopted it. Nothing was sent anlyon mcp tools <name> --refresh, then adopt it again
No one has connected <server> The server signs people in and no account is connected Connect one on the server’s page in the console
"status": "connect_required" naming the server The call was made for an end user (--end-user or ANLYON_END_USER) who has not connected it. Nothing was sent Open connectUrl as that user, or leave the end user out to use your own connection
A tool call times out during wait_for_approval The host’s own limit on a tool call Call check_approval with the same id, and use a shorter timeoutSeconds
.mcp.json is not plain JSON anlyon setup will not rewrite a file it cannot read Fix the file, or add the server by hand

Was this page helpful?