Govern your first agent in under an hour.
Connect your AI, put your tools behind the gateway, set a policy, and see your first signed receipt.
The full step-by-step guide is in your Sandbox.
# Claude Code: put Outhora between Claude and your tools
claude mcp add --transport http outhora <your-gateway-url>
# then, inside Claude Code
/mcp # select outhora and sign inFour words to know.
- Agent
- Who is acting: a Claude Code install, a Claude or ChatGPT connection, or your own agent.
- Tool
- Where it acts: an MCP server such as GitHub, Gmail or your CRM.
- Action
- What it is trying to do, such as merge a pull request or send an email.
- Policy
- What happens next: approve, ask a person, or block.
Six steps to your first receipt.
You need an Outhora account (the Sandbox is free), admin rights in your organization, and an AI to govern.
Sign in and create your organization
Start a free Sandbox at app.outhora.com, name your organization, and add a department such as Sales. You are its admin.
You'll have: An organization and a department to put your agent in.
Connect your AI
Add an agent in Outhora, give it an owner and a department, and choose how it connects. Each agent gets its own identity and one governed connection.
Claude app
In Claude, add a custom connector named Outhora with your gateway URL. On Team and Enterprise plans, an owner adds it for the organization.
ChatGPT
Paste your gateway URL into ChatGPT's connector settings and approve the sign-in.
Your own agent
Generate credentials for the agent in Outhora and call the REST API from any framework that can make an HTTP call.
Using Claude Code? The command is at the top of this page.
You'll have: An agent that shows Connected once it signs in.
Connect your tools
Pick from 21 pre-built servers in the Marketplace, such as GitHub, Gmail or Stripe, or add any MCP server with an API key, bearer token or OAuth 2.0. Its tools sync to your agent.
Then remove the AI's direct connections to those tools.
If Claude can still reach a tool directly, it can go around Outhora and nothing is checked. Only Outhora should be listed for governed tools.
Claude Codeclaude mcp list # see what Claude reaches directly claude mcp remove gmail # repeat for each tool now behind OuthoraIn the Claude app, remove direct connectors under Customize → Connectors.
ConnectionsSample dataYour AI
- Claude CodeConnected
- ChatGPTConnected
- procurement-bot-04 (REST)Connected
Outhora MCP gatewayOAuth 2.0 · PKCEPolicy check · named approver · signed receipt
Systems it acts on
- GitHubGoverned
- StripeGoverned
- GmailGoverned
- NotionGoverned
You'll have: Every tool your agent uses reached only through Outhora.
Set a policy
For each action you care about, choose what clears on its own, what needs a named person, and what is blocked. Start from a template. Actions with no policy don't run; they go to your admins, so nothing slips through.
You'll have: Rules for the actions that matter, with a person on the exceptions.
Choose how approvers hear
The approvals inbox and email work with no setup. Add one-tap Telegram for approvers on the move, or send decisions into your own systems.
You'll have: Approvers who see requests where they already work.
Run a test
Ask your agent to do something your policy sends to a person, such as opening a pull request. Approve it, then open the request's receipt: the decision, who approved it, the policy and an Ed25519 signature.
Receipts / ExportSample dataReceipts this month1,284SignatureEd25519 · verifiedFormatJSON and CSVPublic keyPublished for verificationPolicy snapshotsKept in the audit trailChain check passed: nothing modified, deleted or reorderedYou'll have: Your first governed action and a signed receipt.
Or let Claude set it up.
Claude can do most of the setup in the Outhora app and run the connection commands for you. You handle sign-ins, keys and approvals. Claude never approves its own actions.
- “In my Outhora tab, create a department called Sales.”
- “Add an agent named Claude – Sales in the Sales department, with me as owner, and give me the gateway URL.”
- “Connect Gmail and our CRM in the Marketplace, then show me each policy flow before you activate it.”
Building your own agent?
Use the REST API from any framework that can make an HTTP call. Authenticate the agent, submit the action, and wait for the decision.
When a person approves, you get a single-use approval token that expires in 15 minutes. Pass it to the system that runs the action so it can confirm the approval is real before acting.
curl -X POST https://api.outhora.com/v1/agent-auth \
-d '{
"identifier": "refund-agent",
"secret": "'$OUTHORA_AGENT_SECRET'",
"dept_id": "finance"
}'
# → { "token": "eyJhbGciOi..." } // agent JWTimport requests, time
BASE = "https://api.outhora.com"
def authorize(token: str, action_type: str, context: dict) -> dict:
r = requests.post(
f"{BASE}/v1/actions",
headers={"Authorization": f"Bearer {token}"},
json={"action_type": action_type, "context": context},
).json()
while r["status"] == "pending": # a human is deciding
time.sleep(2)
r = requests.get(
f"{BASE}/v1/actions/{r['request_id']}",
headers={"Authorization": f"Bearer {token}"},
).json()
return r
result = authorize(token, "refund", {"amount": 5000, "customer_id": "cus_8123"})
if result["status"] == "approved":
issue_refund(approval_token=result["approval_token"])
else:
explain_to_customer(result["reason"])The full guide is in your Sandbox.
Step-by-step screens, policy templates and a worked example for a sales team, ready when you sign in.