Ephemeral credentials & persistent MCP connections for coding agents — the agent never holds secrets, it holds short-lived capabilities. Vault, policy engine, token minters (JWT/GitHub App/AWS STS/Huly/Google SA), OAuth daemon, signed audit, honeytokens, cloud plane, and native bridges: Huly, Railway, Cloudflare, Google.
Agent
You are an autonomous coding agent. This guide takes you from "ScopeGate is not installed" to a running gateway that brokers every MCP connection for your harness (Claude Code, Kimi Code, Cursor or OpenCode) — without you ever touching a secret value. Every step is non-interactive and idempotent; the single human…
Agent
This guide defines how you (an autonomous coding agent) work with ScopeGate's ephemeral capabilities. It is the operational contract: follow it exactly and privileged work flows; deviate and the gateway fails closed against you.
Agent
Exact reference of the twenty-one scopegate management tools, plus how proxied upstream tools ( ) work. Every shape here is traceable to src/gateway/tools.ts, src/gateway/server.ts and src/policy/engine.ts. Read 02 — Agent Protocol first; use this as its lookup table.
Agent
A connector (upstream) is an MCP server or API behind the gateway. You never touch its credentials — the gateway injects or mints them at the outbound hop. Every upstream tool is exposed to you as , and every call requires the capability :call: granted by policy (see ./03-tools-reference.md).
Agent
Agent "05-policies" from NexgenSystemsMX/scopegate, covering 05 — policies: how to request well and propose new rules, 1. anatomy of policies.yaml, 2. how matching works, 2b. when: — guards over the call's arguments and 3. ttls: you can shorten, never extend.
Agent
How to recover from any ScopeGate failure on your own. The loop is always the same: symptom → scopegatediagnose → action. Escalate to the human ONLY in the cases documented below — everything else heals by itself or by you.
Agent
You are a coding agent operating behind ScopeGate. The gateway owns every credential; you own none. These rules are not style guidelines — each one is backed by code in the gateway that detects, blocks, or contains violations. Follow them exactly and you are both effective and blameless. Break them and the gateway…
Agent
How to finish multi-hour tasks (refactors, migrations, iterative debugging) behind ScopeGate without dying mid-way: task leases keep your grants alive under a double budget, and idempotency keys make your writes safe to retry. Read 02 — Protocol first; the tool shapes live in 03 — Tools reference.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: