# STACK > Scoped access, live oversight, fast revocation, and signed evidence for AI agents. STACK issues short-lived passports, injects credentials through a scoped proxy, evaluates agent behavior, records decisions in a hash-chained audit log, and revokes access on the next STACK-verified call. ## What changes when an agent runs through STACK - A short-lived EdDSA passport states who the agent is and what it can do. - Every passport carries exactly one Mission. POST /v1/missions/start opens the Mission and issues its passport in one call; completing or revoking the Mission revokes its passports. - The proxy checks scope and injects credentials at the network boundary. - Every non-GET proxy request uses a stable operation ID bound to the exact request. An unchanged retry joins the original operation; a changed request conflicts. - Generic proxy writes receive one STACK dispatch. If the provider may have acted but no response can be proved, STACK reports the outcome as unknown and does not resend automatically. Stripe refunds can use Stripe-native idempotency and provider lookup to recover the original refund. - Runtime and post-run detectors record suspicious behavior and can deny configured actions. - Every layer writes decisions to one hash-chained audit log. - Revocation stops STACK-enforced calls on the next verification and cascades through delegated passports. These functions share operator, agent, passport, Mission, intent, and audit references so one action can be traced from authority through execution and evidence. ## Fleet Missions Connect a service and approve a fleet policy once. The policy defines trusted enrollment, exact connections and actions, review rules and shared limits. An enrolled agent calls stack_start_mission or POST /v1/missions/start with requested_access, requested_operations and narrower limits. STACK resolves that request against the approved policy, stores the Mission’s authorized scope and returns its Passport. Calls must match the Passport, live Mission and current policy. STACK reserves allowance before dispatch and injects the encrypted connection credential only after authorization. Routine allowed work does not require human approval. Renewal preserves the Mission and usage. Review rules require one exact human-approved request. Policy expansion requires approval of a new revision. Supported OAuth token refresh is automatic, while fresh provider consent requires the operator to reconnect the service. ## Current product facts - 131 public MCP tools. - 27 named detectors: 17 real-time and 10 post-run. - 147 preconfigured services. - TypeScript and Python SDKs. - Passport lifetime: 15 minutes by default and 1 hour maximum. - Delegation depth: 4 hops. Scope can only narrow. - Revocation: measured at 10 ms from revoke to rejection using the real Redis path. STACK-enforced paths check live on every call. Offline signature-only verification observes revocation at token expiry unless it also calls the online verifier or subscribes to revocation events. - Proxy response recovery: the final screened and redacted response is encrypted and readable by an authorised caller for up to 24 hours. Status and response reads are unmetered; one admitted operation uses one STACK action. Provider charges remain separate. These counts come from the generated repository facts for the current source. ## Connect an AI client ```sh npx @getstackrun/cli setup ``` The guided setup detects supported MCP clients, configures the STACK endpoint, and starts OAuth where the client permits it. Direct setup details: - MCP endpoint: `https://mcp.getstack.run/mcp` - Transport: Streamable HTTP - Authentication: OAuth 2.1 with PKCE for interactive clients - Discovery: official MCP Registry Keep provider sign-in and credential entry outside the assistant conversation. AgentMail inbound endpoints require an owner or admin to configure the provider signing secret through the REST API or SDK. MCP create/get responses report signing_configured; they do not accept that secret. Setup: https://getstack.run/docs/api/inbound-webhooks. ## Use STACK from code - TypeScript and JavaScript: `npm install @getstackrun/sdk` - Python: `pip install getstack` - CLI: `npx -y @getstackrun/cli auth login` - REST API: `https://api.getstack.run` - MCP: `https://mcp.getstack.run/mcp` - Public JWKS: `https://api.getstack.run/v1/.well-known/jwks.json` ## Security scope In proxy mode, the agent does not receive the upstream secret. Credentials are KMS-encrypted at rest and injected only for the approved call. PII does not enter passport JWTs. The token carries an opaque claim reference. The MCP proxy surface includes `stack_proxy_request` and `stack_get_proxy_operation`. The operation ID is correlation, not authentication: current tenant, agent, Passport, connection, authority and request scope are rechecked before metadata or a stored response is returned. Service grants define which connected services may supply data to each destination. Missing or empty grants allow no cross-service flow. A grant wildcard is resolved to exact service names before a Passport is signed; Passports and delegated Passports can only inherit or narrow that list. MCP can start an existing identity-provider verification flow, but returns only the session reference, provider URL or QR data, and expiry. Identity documents, raw proof, PII, provider tokens, and credentials stay outside the MCP response. STACK is not SOC 2 attested. The EU AI Act page is a product mapping, not legal advice or a claim of full compliance. The agent security guide explains where identity providers, credential brokers, MCP gateways, sandboxes and runtime controls act, and how STACK connects authority, credential use, runtime decisions, evidence and revocation across a protected request. ## Public routes - [Home](https://getstack.run/) - [Product](https://getstack.run/product) - [How to secure an AI agent](https://getstack.run/agent-security) - [Pricing](https://getstack.run/pricing) - [EU AI Act mapping](https://getstack.run/compliance/eu-ai-act) - [Docs](https://getstack.run/docs) - [Contact](https://getstack.run/contact) - [Privacy](https://getstack.run/privacy) - [Terms](https://getstack.run/terms) - [Extended LLM summary](https://getstack.run/llms-full.txt) ## Contact - General: hello@getstack.run Never send credentials by email.