Governed execution for people and AI agents
Standing access is the risk. Alpacon governs every action by a person, a pipeline, or an AI agent through time-bound work sessions: intent is declared, sensitive actions are approved, risk is scored in real time, and everything lands in a recorded, AI-analyzed audit trail.
# Request a time-bound work session,# then open a browser terminalalpacon work-session create \ --purpose "nginx fix" \ --scope websh --server web-01 \ --expires-in 2h --wait --usealpacon websh web-01# Automation authenticates with an API token# access is scoped by the token's server allowlistalpacon login --workspace myworkspace \ --region us1 -t $ALPACON_API_TOKENalpacon exec web-01 -- systemctl restart nginx# Connect an AI agent over MCP# (hosted, browser sign-in, no token)claude mcp add --transport http \ alpacon https://mcp.alpacon.io/mcp # Then ask in plain language:# "List servers in the production workspace"For people and AI agents
People work from a secure browser terminal. Automation runs from the CLI and API. AI agents connect through MCP. The same work session model governs all three.
Governed by default
No standing credentials. Every session is scoped to specific servers and a time window, approved when it matters, risk-scored as it runs, and recorded end to end. You connect as yourself.
Zero to production
Register a server, request a session, and start working in the browser or from CI/CD. No SSH keys, no VPN, nothing left behind when the session ends.
How it works
One governed path for every action: request, approve, audit.
- 1
Request
Ask for the servers, features, and time window you need, with a stated purpose.
Work sessions - 2
Approve
A user with the Superuser role reviews each request before access is granted.
Approvals - 3
Audit
Every session and the activity inside it is recorded end to end.
Audit
Start with your role
Jump straight into the guide built for how you use Alpacon.