Docs

LEASH documentation

Everything you need to put your agents behind LEASH: set up, policies, the proxy, the CLI and the API.

Quickstart

1. Create an account at /app with a passkey. No password or email.
2. Sign in the CLI and approve the code it shows in the app:

   npx leashcli login

3. Vault a key. Paste it once; it is encrypted and never written to disk:

   npx leashcli add github prod

4. Mint a token for your agent (or do it in the app under Agent tokens):

   npx leashcli creds                      # find the key id
   npx leashcli token <key-id> --label coding-agent

5. Connect your agent. Add LEASH to your MCP client's config (see below).

Concepts

Connecting your agent (MCP)

npx leashcli mcp runs a local MCP server that gives your agent a request tool for each provider in LEASH_TOKENS. Add it to any MCP client's server config. List several providers separated by commas:

{
  "mcpServers": {
    "leash": {
      "command": "npx",
      "args": ["-y", "leashcli", "mcp"],
      "env": { "LEASH_TOKENS": "github=lsh_aaa,stripe=lsh_bbb" }
    }
  }
}

The tool tells the agent that held calls need a human, so a well-behaved agent stops and gives you the approval link instead of looking for another way in. Any MCP client works the same way.

Calling through the proxy

Any agent, script or SDK can use LEASH directly. Swap the provider's base URL for the LEASH proxy and the real key for your token:

https://leash.gautamkhosla.com/p/<provider>/<path>
Authorization: Bearer lsh_...

curl https://leash.gautamkhosla.com/p/github/repos/acme/app/pulls \
  -H "Authorization: Bearer lsh_..."

LEASH checks the call, swaps your token for the real key, forwards it to the provider and returns the response unchanged, plus an x-leash-decision header (allowed or approved). Cookies from upstream are stripped.

When a call is held

A held call returns HTTP 428:

{
  "error": "held_for_approval",
  "hold_id": "4f2a...",
  "approve_url": "https://leash.gautamkhosla.com/app#hold=4f2a...",
  "rule": "rw.mutation",
  "message": "LEASH held this request because it cannot be undone..."
}

Open the link, check the method, host, path, reason and the request preview, and approve with your passkey. Then retry the exact same request once. Run npx leashcli watch to get a terminal bell and link for every new hold.

Token policies

Each token can carry a policy that narrows what its key can do. A policy can never widen it.

{
  "allow":  [{ "method": "GET", "path": "/repos/acme/**" }],
  "deny":   [{ "path": "/orgs/**" }],
  "hold":   [{ "method": "POST", "path": "/repos/*/*/releases" }],
  "default": "allow",
  "readOnly": false,
  "perMinute": 120,
  "unattendedIrreversible": []
}

A rule is { "method": "GET", "path": "/glob" }. * matches one path segment, ** any depth, {a,b} alternatives. Paths are relative to the provider's API base. Evaluation order: deny, readOnly, the irreversible map, hold, allow, default.

Recipes

Read-only access to one GitHub org:

{ "readOnly": true, "allow": [{ "path": "/repos/acme/**" }, { "path": "/orgs/acme/**" }] }

Hold every write to Stripe, not just the money-moving ones:

{ "allow": [{ "method": "GET", "path": "/v1/**" }], "default": "hold" }

Providers and the map

LEASH supports GitHub, Cloudflare, Railway, Stripe and Supabase. The current irreversible map, with the reason for every rule, is on the homepage and at GET /v1/meta. Every DELETE is held on every provider, plus provider-specific calls such as force pushes, repo transfers, Railway volume deletes, Stripe refunds and payouts, Cloudflare cache purges, and any SQL on Supabase or D1 that is not a single plain read (SELECT, WITH ... SELECT, EXPLAIN without ANALYZE, SHOW). Railway mutations are held unless every field is a redeploy or restart. Paths are matched in one canonical form (no empty segments, one trailing slash dropped, GitHub owner and repo lowercased) and that same path is sent upstream. A body LEASH cannot read on a route with a body rule is held.

CLI

Run any command with npx leashcli, or install it globally with npm i -g leashcli.

API

Base URL https://leash.gautamkhosla.com. Account endpoints use your session (web cookie or CLI bearer). Web writes need the same Origin and an x-leash: 1 header. Endpoints marked passkey only work from the web app.

Errors