What it does
An agent holds one thing: a session token for its job. It reaches GitHub, git and package registries only through Valet, which
- mints narrow credentials per job, such as a GitHub token for one repository with only the permissions its role needs, and never hands them to the agent;
- checks every action against policy: a reviewer agent can comment but not approve or merge; an implementer can push only to its own branch;
- audits every decision, allowed or denied, in a tamper-evident log, and alerts you when something is refused.
The agent's container has no route to the internet except through Valet, and nothing worth stealing inside it.
Status
Valet is being built in the open. GitHub over MCP, the git proxy, the egress allowlist and container enrollment work today; approvals, the admin UI and more connectors are next. Follow along on GitHub.