Stitchwork sits between your AI clients and the MCP servers they call. Curate the exact tools each agent gets, rotate credentials in one place, and see every call — the single pane of glass for everything your agents touch.
A single MCP server hands your agent every tool it ships with. The agent gets the whole keychain — root on your database, write access to Linear, full Slack — the moment you plug it in. There's no scoping, no rotation, no audit log. That's the world we're shipping into.
Every MCP server is a take-it-or-leave-it bundle of tools. You wanted query; you also got execute, truncate, and drop_schema.
Your Postgres URL is in Claude Desktop's config. Your GitHub PAT is in Cursor's. When the intern leaves, you're not rotating — you're hunting.
An agent ran. Something changed. There's no log, no actor, no chain of custody. Which token called what tool, against which upstream, with what arguments? "What did the AI do?" is a question with no answer.
Stitchwork is a proxy. Connect upstreams. Curate the tools. Issue scoped tokens. Watch every call. Your agents point at one URL instead of twelve — and you finally get to see (and decide) what they do.
Bring GitHub, Linear, Postgres, Stripe, your own — 200+ servers and growing. OAuth or PAT. Stitchwork stores the credential once, encrypted, and proxies every call through it.
Permission sets are tool-level allowlists. Pick query but not execute. Pick issue.list but not issue.delete. Read‑only is the default. Anything destructive is opt‑in, every time.
An agent token is a scoped, expiring credential. Paste it into Claude Desktop, Cursor, or curl. It only works against the permission set you attached — nothing more. Revoke it and every client loses access in the same heartbeat.
# ~/Library/Application Support/Claude/claude_desktop_config.json
"mcpServers": {
"stitchwork": {
"url": "http://localhost:8095/mcp",
"headers": { "Authorization": "Bearer bb_pat_live_a3f1c8…" }
}
}
Stitchwork is a proxy, so every call has to pass through it — which means every call is a row in the log. Token, tool, arguments, response, latency, outcome. Searchable, exportable, queryable. The single pane of glass nobody has today.
Token, tool, connection, latency, outcome — every call lands in a structured feed. The proxy you stand up in five minutes is the same one your auditor asks for at the end of the year.
A live snapshot of the proxy. Traffic over the last seven days, what's healthy, what's expiring, and what's running next.
New permission sets ship with zero tools allowed. Every dangerous tool is opt-in, every time. There is no "convenient" path to handing an agent root.
Token, tool, arguments, response, latency, outcome — structured, queryable, exportable to S3 or your SIEM. When something weird happens, you can actually answer "what did the AI do?"
Upstream tokens are encrypted at rest, rotated on schedule, and never exposed to clients. When the intern leaves, you rotate one credential — not twelve.
Stand up Stitchwork in your VPC with a single Docker image — nothing leaves your perimeter — or run it on our cloud. Same code either way.
Any client that speaks MCP — Claude Desktop, Cursor, Continue, your own — works without changes.
GitHub, Linear, Postgres, Slack, Stripe, Sentry, AWS, GCP, and counting. Bring your own MCP server.
One Docker image. Postgres + Redis. Nothing else. Air-gapped install on request.
We're shipping with a small set of design partners while we harden the proxy. Request access and we'll get you in the queue.
Private beta closes when we hit 50 teams. We pick from the list weekly. Tell us what you're plugging in and we'll get you a key.