TEND / Docs
Connect an agent and verify one real action
The Connect page in TEND walks you through four steps. Everything it shows comes from what TEND really recorded; nothing is simulated.
Your first agent
Create
Name the agent. TEND creates it and its key, shown once.
Permissions
Choose Allow, Ask me first or Never for each tool. Everything starts blocked.
Connect and test
Paste one command where the agent runs, then allow or deny its test request in TEND.
Result
TEND reports verified only when the approval was spent and the gateway recorded the call for that same approval.
What you need
- A TEND account (beta accounts are approved by hand).
- Node 18 or newer and a Unix-style shell where the agent runs.
- For real protection: the agent must not hold the credentials for what it asks to do.
- HTTPS for anything beyond a local test.
Ways to connect
Coding agents
Claude Code, Cursor and Cline through TEND’s hooks or its MCP proxy.Model SDKs
The Anthropic SDK and any OpenAI-compatible API, through TEND’s adapters.Agent frameworks
LangChain, LangGraph, CrewAI, AutoGen, PydanticAI, Mastra and the OpenAI Agents SDK.Anything else
Any agent that can make an HTTP request can use TEND’s HTTP API: ask, wait, spend, then act.
How it holds
Approval binding
An approval is a single-use authorization bound to the exact agent, tool, action, resource and detail. Its token is 256 random bits, stored only as a hash, and spent by one atomic database update that checks the token, its expiry, the current policy and the bound request together, so nothing changes between the check and the spend. A changed request is refused without using up the approval, and three such attempts revoke it. Another agent’s approvals look like they don’t exist.
Credential isolation
In gateway mode the credential is read from TEND’s environment when the call runs and passed only to the tool; it is never stored, logged or returned. The gateway derives what a person approves from the real parameters, both when asked and when run, and its token lasts 60 seconds. This is a boundary only once the credential is gone from everywhere the agent can reach.
Fails closed
Every refusal, database error or missing credential happens before the tool runs; only a successful spend reaches it. With TEND unreachable, a call was refused after about one second and none ran. An unreadable rule set denies everything, and there is no break-glass path.
Tamper-evident log
Requests, decisions, policy changes and revocations go to an append-only log, each entry carrying the hash of the one before. npm run tend -- audit-verify checks the chain and prints the head hash; keep it outside TEND. The chain detects tampering, it doesn’t prevent it.