Your agent acts. Overs/ash controls.
One gateway to every service your agent touches. You decide: deny, approve once, or approve all.
Approvals
3 waiting · auto-refresh 5sdeploy-bot to create a pull request?github:create_pull_request:overfolder/appagent:research-bot fetched github:list_repos — bubbled to henryagent:ci-runner denied aws.s3.delete_objectOne gateway between your agent and everything else.
Overslash sits between agents and the outside world. It handles secrets, OAuth, MCP, permission chains, human approvals, and authenticated HTTP execution. The agent doesn't hold keys. You don't hold your breath.
Agent identities, in a tree
Every agent gets an identity, a parent, and a blast radius. Sub-agents inherit rules from their parent — until you narrow them.
Human approvals, on tap
The first time an agent wants a permission, you approve or deny. Allow & Remember at the scope ladder you choose.
OAuth & secrets, handled
One place for client IDs, tokens, signing keys. Rotate, revoke, per-agent. No credentials ever touch the agent's context window.
Audit that reads like prose
Every call, every bubble-up, every deny. Streaming, searchable, exportable.
MCP-native
Enroll any MCP client in a click — Claude Desktop, your own. Overslash brokers the tools, the credentials, and the approvals. The agent just asks.
Permission chains
A sub-agent bubbles up to its parent when it hits an unknown scope. Parents bubble to humans. Denials are first-class and recorded.
Agents ask. Overslash mediates. Services respond.
Any MCP-capable agent — Claude Code, Overfolder, OpenClaw, or your own — connects to Overslash once. Overslash holds the credentials, enforces the rules, and hands each service an authenticated, audited request.
A service registry your agent already knows.
First-class templates for the things agents actually touch. And a generic http service for anything else you can point a URL at.
Free in self-hosted. Cloud free for individuals. Paid for teams.
Three ways to use Overslash. Self-hosted gives you everything for free. Your Personal org on Cloud is free, forever. When you want to bring colleagues, create a Team org at €3 per seat.
Run it yourself. Full features — no gating, no license keys, no telemetry. Elastic License 2.0.
- All features, no gating
- Unlimited agents, actions, integrations
- Local secrets vault
A hosted Personal org, just for you. Always free, no card required.
- Personal org with all integrations
- Hosted backups & upgrades
- Personal audit log
- All Cloud features for one user
Create Team orgs and bring your colleagues. Every seat €3. Your own Personal org stays free.
- Everything in Personal
- Multiple Team orgs
- SSO (Google, GitHub, SAML)
- Shared connections & secrets
- Audit log export
- Pooled usage with metered overages
Read it. Fork it. Run it.
The gateway core is licensed Elastic 2.0. The services registry — the part the community contributes to — is MIT. No telemetry. No phone-home. Written in Rust and SvelteKit.
# clone, build, run — local dev $ git clone https://github.com/overfolder/overslash $ cd overslash $ make install $ overslash web # ready on http://localhost:7171 # signing key generated · audit db initialised # paste the enrollment link into your MCP client
Give this to your agent.
Paste the block below into Claude, Cursor, Open Interpreter, or any MCP-capable agent. It will follow the skill, enroll itself under your Overslash account, and ask you for permissions as they come up.