Caracal gives AI agents authority, not credentials: short-lived, scoped, instantly revocable access to tools, APIs, and MCP servers. Every action is approved by policy before it runs.
Real credentials are attached server-side after approval and expire in minutes. Agent code, prompts, and logs have nothing to steal.
Unlimited agents under one credential, each individually attributed, policed, and revocable. No shared service accounts, no credential sprawl.
Every request is checked against your policy up front, down to the exact endpoint, and rules change without redeploying a single agent.
Access tokens live minutes and work exactly once. A leaked or replayed token is rejected at the gate and flagged in audit.
Agents can hand work to sub-agents, never with more access than they hold. Every hop is re-verified on every call.
Cut off a runaway agent and everything it delegated loses access at once, even responses already streaming stop mid-flight.
Sensitive actions pause for approval. Each decision unlocks exactly one request and can never be reused for anything else.
Every allow, deny, and approval lands in an append-only, tamper-evident trail you can export and hand to auditors.
Put a verification gate in front of any API or MCP server, or verify in-process with drop-in framework adapters.
One SDK to give agents short-lived, gateway-routed authority in TypeScript, Python, or Go.
import { Caracal } from "@caracalai/sdk" // Loads your profile or environment config. // No provider keys anywhere in your code. const caracal = new Caracal()
- TypeScript
- Python
- Go
- Any CLI via caracal run
- LangChain
- LangGraph
- CrewAI
- OpenAI Agents SDK
- Custom agents
- API key
- OAuth 2.0 user (authorization code)
- OAuth 2.0 machine (client credentials)
- Bearer token
- Caracal mandate
Caracal is a small set of self-hosted services, each owning one bounded part of the authority lifecycle. Backed by Postgres and Redis, deployed with Docker Compose or Helm.
STS
decidesThe decision point for all authority.
- +Policy-checked token exchange
- +Short-lived signed mandates
- +Human approval holds
- +End-user identity federation
Gateway
enforcesFronts your APIs and verifies every request.
- +Per-request mandate verification
- +Replay and revocation checks
- +Injects upstream credentials
- +Safe, audited egress
Coordinator
tracksOwns the live authority graph.
- +Agent sessions and leases
- +Delegation graph
- +Cascading termination
- +Lifecycle events
Audit
provesTurns every decision into evidence.
- +Signed event ingestion
- +Tamper-evident hash chain
- +Retention and export
- +Query and search
Admin API
managesThe programmable control plane.
- +Zones, applications, resources
- +Providers and their secrets
- +Policies and grants
- +Automation via Admin SDK
Console
operatesThe operator surface for the platform.
- +Manage the whole platform
- +Inspect sessions and delegations
- +Decide pending approvals
- +Explain any request
Built by a community of 20+ contributors.
