MCP & AGENTS
MCP servers and agents, governed like production.
BETARun MCP servers, connect hosted ones from vendors like GitHub, Sentry, Linear and Notion, approve exactly which tools agents may call, cap what each run can spend, and expose Talos itself to MCP clients through scoped keys.
SEE IT RUN
THE MANUAL WAY
What happens when agents get tools nobody reviewed.
THE TOOL THAT CHANGED UNDER YOU
An MCP server updated overnight. One of its tools gained a new parameter that deletes things, and every agent connected to it got that ability without anyone deciding they should.
THE RUN THAT NEVER STOPPED
An agent got stuck in a loop over the weekend. The token budget existed in a config file and was enforced by nothing, and the invoice arrived on Monday.
THE PERSONAL TOKEN IN THE CONFIG
To connect a tool, someone pasted their own long-lived token into a shared config. Every agent now acts as them, with all of their access.
WHAT TALOS DOES
Six controls between an agent and your systems.
A registry of servers
Run MCP servers as containers or connect hosted ones. Vendor servers sign in through OAuth, with tokens refreshed automatically rather than pasted.
Tools pinned by hash
Each tool’s definition is approved as it is. If a server changes a tool, the change is flagged as drift and the new version is not callable until it is approved.
Destructive tools need a second person
Tools that write or delete can require approval before they run, using the same two-person verification as the rest of Talos.
Agents with real budgets
Token and step limits are checked after every step, not totalled at the end, so a runaway run is stopped while it is running.
Talos as an MCP server
MCP clients can reach Talos through scoped, hashed API keys. Browser login sessions are not accepted there, and every call is limited by the key’s scopes and its owner’s live permissions.
Evaluations, replay and retention
Evaluation suites scored by fixed rules rather than another AI model, replay of past runs for debugging, analytics, and retention rules for what runs leave behind.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
An agent can only do what someone approved, at the version they approved.
Approving a tool by name is not enough when the server behind it can change what that name does. Talos records each tool’s definition by hash at the moment it is approved, and a server that later changes the definition gets that tool held back until a person looks at the new one. The same principle runs through the type: limits are checked while a run is happening rather than reported after it, and a key minted for an MCP client can only narrow what its owner can already do, and never widen it.
RELATED CAPABILITIES
Connect one server, read-only.
Talos lists its tools and asks you to approve them before any agent can call one.