AI agent passport and control plane for agentic work.

Issue passports, authorize tool calls before execution, and audit what happened.

Website · Docs · Quickstart · Spec · Contact

APort is a control plane for AI agents that act through tools. It gives every agent a passport, checks policy before an action runs, and records signed allow/deny decisions for audit.

The core idea is simple:

• Identity: who is this agent, who owns it, and what assurance level does it have?
• Policy: what capabilities, limits, regions, and contexts are allowed?
• Guardrails: should this tool call run right now?
• Proof: what was decided, why, when, and for which passport?

APort is built around the Open Agent Passport (OAP), an open model for agent identity, capabilities, limits, status, and decision records.

%%{init: {"theme": "base", "themeVariables": {"background": "#06090f", "primaryColor": "#0d1117", "primaryTextColor": "#e8ecf1", "primaryBorderColor": "#22d3ee", "lineColor": "#7a8ba3", "secondaryColor": "#111827", "tertiaryColor": "#020617", "fontFamily": "Inter, ui-sans-serif, system-ui"}}}%%
flowchart TB
A["Agent tool call"]
A --> B["Framework hook<br/>Claude Code · Cursor · OpenClaw · MCP"]
B --> C["APort verify"]
C --> D["Load passport"]
D --> E["Evaluate policy limits"]
E --> F{"Decision"}
F -->|"ALLOW"| G["Tool executes"]
F -->|"DENY"| H["Tool blocked"]
G --> I["Audit decision"]
H --> I
I --> J["Reason · context<br/>timestamp · signature"]
classDef node fill:#0d1117,color:#e8ecf1,stroke:#22d3ee,stroke-width:1px;
classDef decision fill:#020617,color:#e8ecf1,stroke:#67e8f9,stroke-width:2px;
classDef allow fill:#0d1117,color:#e8ecf1,stroke:#10b981,stroke-width:2px;
classDef deny fill:#0d1117,color:#e8ecf1,stroke:#ef4444,stroke-width:2px;
class A,B,C,D,E,I,J node;
class F decision;
class G allow;
class H deny;

APort runs at the tool boundary. It is not a prompt, policy reminder, or post-hoc log parser. If the passport does not authorize the action, the action does not run.

Claude Code:

curl -fsSL https://aport.io/install.sh | bash -s -- claude-code

Or use the npm package directly:

npx --yes @aporthq/aport-agent-guardrails claude-code

Non-interactive hosted setup:

npx --yes @aporthq/aport-agent-guardrails claude-code \
--quick-hosted \
--email you@example.com \
--non-interactive

The installer can create a hosted passport, create a narrow passport-bound setup key, write the framework hook/config, and start sending decisions to APort.

%%{init: {"theme": "base", "themeVariables": {"background": "#06090f", "primaryColor": "#0d1117", "primaryTextColor": "#e8ecf1", "primaryBorderColor": "#22d3ee", "lineColor": "#7a8ba3", "secondaryColor": "#111827", "tertiaryColor": "#020617", "fontFamily": "Inter, ui-sans-serif, system-ui"}}}%%
flowchart TB
P["Agent passport"]
P --> C1["system.command.execute"]
C1 --> L1["commands · blocked patterns · timeout"]
L1 --> C2["data.file.read / write"]
C2 --> L2["paths · secret patterns · file size"]
L2 --> C3["web.fetch / browser"]
C3 --> L3["domains · methods · rate limits"]
L3 --> C4["mcp.tool.execute"]
C4 --> L4["servers · tools · parameter size"]
L4 --> C5["repo.pr.create / merge"]
C5 --> L5["repos · branches · PR size · review rules"]
L5 --> C6["messaging.send"]
C6 --> L6["recipients · daily caps · approval"]
L6 --> C7["data.export"]
C7 --> L7["row caps · PII · collections"]
L7 --> C8["agent.session.create"]
C8 --> L8["concurrency · duration · session type"]
classDef root fill:#020617,color:#e8ecf1,stroke:#67e8f9,stroke-width:2px;
classDef node fill:#0d1117,color:#e8ecf1,stroke:#7a8ba3,stroke-width:1px;
classDef leaf fill:#111827,color:#e8ecf1,stroke:#22d3ee,stroke-width:1px;
class P root;
class C1,C2,C3,C4,C5,C6,C7,C8 node;
class L1,L2,L3,L4,L5,L6,L7,L8 leaf;

Defaults are intentionally developer-friendly, but sensitive operations still have hard stops. For example, sensitive file reads such as .env*, .aws/*, .ssh/*, and *credentials* can be blocked by default while teams tune exact policies for their environment.

APort supports both hosted and local enforcement:

Hosted mode is fail-closed by default. If the API cannot be reached, sensitive tool calls are denied rather than silently downgraded.

APort is designed for teams that need more than a prompt-level rule:

• Organization context: team-owned passports, scoped setup keys, member roles, and org-wide audit.
• Multi-tenant issuance: template passports can mint instance passports for devices, users, tenants, or customer installs.
• Data residency: passport, policy, and audit data can be routed by tenant and region.
• Kill switch: suspend a passport and stop future tool authorization.
• Evidence: decisions include policy id, allow/deny result, reasons, timestamps, assurance level, and integrity metadata.
• Enterprise deployment: self-contained device deployment, enforcement, and uninstall scripts for IT-managed fleets.

Agentic systems are moving from chat into execution: shell commands, file edits, browser actions, MCP tools, repo operations, exports, messages, and payments. Traditional controls do not map cleanly:

• Prompts are advisory.
• Output filters run after the model has already planned the action.
• Sandboxes contain blast radius but do not answer whether the action was authorized.
• Generic API keys identify software, not the agent passport, owner, limits, and reason for a specific action.

APort fills the missing layer: pre-action authorization for agent tools.

• Website: aport.io
• Quickstart: aport.io/quickstart
• Framework docs: aport.io/frameworks
• Blog: aport.io/blog
• OAP spec: github.com/aporthq/aport-spec
• Support: support@aport.io