Welcome to Permaura
Permaura is a permission layer for AI agents. Its one-line promise: give agents permission, not keys.
Your AI agents — Claude Code, Codex, Cursor, ChatGPT, remote MCP agents — increasingly need to do things: refund a charge, deploy a branch, query a database, send an email. The naive way is to hand the agent an API key. The moment you do, the secret lives in the model's context, its logs, and its blast radius.
Permaura sits in between. The agent calls a capability (braintree.transactions.refund), Permaura checks policy, injects the real secret server-side on your gateway, performs the action, and returns only the result. The key never reaches the model.
Think 1Password + a policy engine + an MCP gateway, with a local-first trust anchor and an optional cloud you only reach for when you want to.
Pick your way in
I want it working
Seven steps from a new account to an agent doing real work under your rules.
Get startedI want to understand it first
The enforcement loop, the four objects, and where your gateway can run.
How it worksI want the API
The CLI, the npm package, and the gateway's REST v1 API. Nothing is hidden behind the console.
Developer docsPress ⌘K (or CtrlK) to search every page. The index is built into the site, so it works instantly and offline.
What's in here
| Section | What it covers |
|---|---|
| Get started | The end-to-end path: create an account → connect a gateway → go live → add a connection → connect an agent → grant it access → open it up to agents anywhere. |
| Core concepts | The enforcement loop, the four objects you'll work with (Connection, Policy, Grant, Agent), and where your gateway can run. |
| The console | A page-by-page walk through permaura.com — dashboard, agents, connections, policies, grants, approvals, the audit log, and the vault. |
| Guides | Task-shaped walkthroughs: point a specific AI client at your gateway, and broker SSH access to a server you own. |
| Owner & admin handbook | Running Permaura for other people: who can do what, adding and removing them, what to watch, and playbooks for when something looks wrong. |
| Security & access | Human and device-signed approvals, two-step verification, and how organisations and workspaces fit together. |
| Plans & billing | What each tier unlocks, how the free trial works, and managing your subscription. |
| Help | Fixes for what commonly goes wrong, short answers to common questions, and how to remove Permaura cleanly. |
| Developers | The permaura CLI — running a gateway and driving one — and the gateway's REST v1 API. |
Look around before you commit
Every screenshot in this guide was captured against the live console. Sign in with either shared demo account to follow along — both open in demo mode, so you get a fully working console populated with sample data before you connect anything real.
| Name | Password | |
|---|---|---|
| Ada Lovelace | ada.demo@permaura.com | DemoPass2026! |
| Grace Hopper | grace.demo@permaura.com | DemoPass2026! |
Anyone reading these docs can sign in to them. Treat anything you put there as public, and never point a demo account at a real credential.
In demo mode the console shows sample agents, connections, grants, and approvals so you can explore safely. Every action works, but nothing is written and nothing is real. The moment you connect your own gateway, the console switches to your live data — see Go live.
Prefer to start clean? Skip the demo entirely and go straight to connecting a gateway.