
Delego
A policy engine and approval layer that sits between your AI agent and credential brokers like Agent Vault, OneCLI, or Browser Use. It answers whether a specific action matches the original human intent, not just whether the credential is valid. Exposes tools for proposing actions, resolving approved ones, and reading audit logs. Policy rules match on HTTP method, host, and path with constraints like spending caps and allowlists. Approvals are single-use and bound to exact action fingerprints so an agent can't reuse permission for action A to run action B. Audit receipts form an Ed25519-signed hash chain. Reach for this when you want deterministic, non-LLM guards against confused deputy attacks and a tamper-evident log of what your agent actually did.
- GitHub stars
- 25
- tools
- 5
- transport
- STDIO
- env var
- 1
- last updated
- Jun 11, 2026
Tools
5 toolsPublic tool metadata for what this MCP can expose to an agent.
delego_propose_actionsubmit an action; returns allow / deny / needs_approval
submit an action; returns allow / deny / needs_approval
No parameter schema in public metadata yet.
delego_resolve_actioncomplete an approved action (fingerprint must match)
complete an approved action (fingerprint must match)
No parameter schema in public metadata yet.
delego_pendinglist actions awaiting human approval (read-only)
list actions awaiting human approval (read-only)
No parameter schema in public metadata yet.
delego_audit_tailread recent receipts
read recent receipts
No parameter schema in public metadata yet.
delego_show_policyshow the active policy
show the active policy
No parameter schema in public metadata yet.
Sponsors
Configuration
DELEGO_HOMEDirectory holding the policy, signing keys, and audit ledger (defaults to ~/.delego). Set this to keep state project-scoped, e.g. /abs/path/to/project/.claude/.delego.
Readme
delego
Website: delegohq.com · Docs: delegohq.com/docs · Spec: Delego-Dev/specification
Intent-bound action authorization for AI agents. It sits between an agent and whatever credential broker holds the user's secrets, and it answers the one question brokers don't: is this specific action the thing the human actually asked for?
Details
- Repository
- github.com/delego-dev/delego
- Website
- delegohq.com
- Category
- Security & Pentesting
- Package
delego- Transport
- STDIO
- Registry
- MCP registry, active