Alpacon

Governed execution for people and AI agents

Standing access is the risk. Alpacon governs every action by a person, a pipeline, or an AI agent through time-bound work sessions: intent is declared, sensitive actions are approved, risk is scored in real time, and everything lands in a recorded, AI-analyzed audit trail.

Get started Set up your workspace

For people and AI agents

People work from a secure browser terminal. Automation runs from the CLI and API. AI agents connect through MCP. The same work session model governs all three.

Governed by default

No standing credentials. Every session is scoped to specific servers and a time window, approved when it matters, risk-scored as it runs, and recorded end to end. You connect as yourself.

Zero to production

Register a server, request a session, and start working in the browser or from CI/CD. No SSH keys, no VPN, nothing left behind when the session ends.

How it works

One governed path for every action: request, approve, audit.

1
Request
Ask for the servers, features, and time window you need, with a stated purpose.
Work sessions
2
Approve
A user with the Superuser role reviews each request before access is granted.
Approvals
3
Audit
Every session and the activity inside it is recorded end to end.
Audit

One model, every actor

Declared intent, approval, real-time risk scoring, and a recorded, AI-analyzed audit trail. People, pipelines, and agents.

# Request a time-bound work session,
# then open a browser terminal
alpacon work-session create \
  --purpose "nginx fix" \
  --scope websh --server web-01 \
  --expires-in 2h --wait --use
alpacon websh web-01

# Automation authenticates with an API token
# access is scoped by the token's server allowlist
alpacon login --workspace myworkspace \
  --region us1 -t $ALPACON_API_TOKEN
alpacon exec web-01 -- systemctl restart nginx

# Connect an AI agent over MCP
# (hosted, browser sign-in, no token)
claude mcp add --transport http \
  alpacon https://mcp.alpacon.io/mcp

# Then ask in plain language:
# "List servers in the production workspace"