Alpacon
Governed execution for people and AI agents
Standing access is the risk. Alpacon governs every action by a person, a pipeline, or an AI agent through time-bound work sessions: intent is declared, sensitive actions are approved, risk is scored in real time, and everything lands in a recorded, AI-analyzed audit trail.
For people and AI agents
People work from a secure browser terminal. Automation runs from the CLI and API. AI agents connect through MCP. The same work session model governs all three.
Governed by default
No standing credentials. Every session is scoped to specific servers and a time window, approved when it matters, risk-scored as it runs, and recorded end to end. You connect as yourself.
Zero to production
Register a server, request a session, and start working in the browser or from CI/CD. No SSH keys, no VPN, nothing left behind when the session ends.
One model, every actor
Declared intent, approval, real-time risk scoring, and a recorded, AI-analyzed audit trail. People, pipelines, and agents.
👨💻 For engineers
# Request a time-bound work session,
# then open a browser terminal
alpacon work-session create --purpose "nginx fix" \
--scope websh --server web-01 --expires-in 2h --wait --use
alpacon websh web-01⚙️ For automation
# Automation authenticates with an API token
# (token auth is not work-session gated)
alpacon login --workspace myworkspace --region us1 -t $ALPACON_API_TOKEN
alpacon exec web-01 -- systemctl restart nginx🤖 For AI agents
# Connect an AI agent over MCP
# (hosted, browser sign-in, no token)
claude mcp add --transport http alpacon https://mcp.alpacon.io/mcp
# Then ask in plain language:
# "List servers in the production workspace"Start exploring
Choose your path to get started with Alpacon