Governed AI agents for the software your company already runs

Elaichi is an agent platform for companies. It connects the software a business already runs on and lets agents work in those systems, without ever exceeding what the person they act for is allowed to do. Instead of each employee minting ad-hoc MCP servers with personal API keys, Elaichi connects your tools once, turns them into curated toolboxes, and puts them behind one org-wide endpoint that each person signs in to as themselves, clamped by roles, restrictions, and audit logging.

Four steps. Connect: pick from 400+ connectors and finish a hosted connect flow, where credentials are vaulted and encrypted. Compose: every connection instantly becomes a toolbox of MCP tools, or you curate a template toolbox with renamed tools, pinned parameters, and defaults. Authorize: point Claude, ChatGPT, Cursor, any MCP client or the Elaichi Agent at the one org-wide endpoint and sign in with OAuth. No per-toolbox URL and no embedded token. Govern: roles decide who can do what, restrictions decide which tools are even visible, and every call lands in an append-only audit log.

You share a capability, not a password. A shared toolbox can expose the sharer's connection: recipients call the third-party API through it without ever seeing credentials, and cannot step outside the tools and parameters you fixed. Every call is clamped server-side by the toolbox's tool list, pinned parameters, and restrictions.

One offboarding action. Removing a member runs a preflight over the personal connections that shared toolboxes depend on, so you transfer or delete them deliberately rather than discovering the gap later. Their access ends on the next request, every share they held goes with them, and the record of what they called stays in the audit log.

Yes, and restrictions work on individual tools rather than whole applications. Set an allow or block rule on a role or on one person, and a person-level rule replaces the role's. A blocked tool is never advertised to the model, so it cannot be asked for, and the rule is enforced again at execution.

That is what automations will do. A schedule, an incoming event, or a message starts a sequence of steps that call tools, transform results, branch, wait, and pause for a person to approve the ones that matter. Every step will run inside the same permissions and land in the same audit log. Automations and live dashboards are launching soon, on the Black plan, and are not available yet.

Any MCP client that speaks Streamable HTTP. Claude, ChatGPT and Cursor connect directly today, as does the Elaichi Agent. Elaichi MCP endpoints speak standard MCP JSON-RPC (initialize, tools/list, tools/call), and the desktop companion app writes Claude Desktop and Cursor config files for you, so nobody has to hand-edit JSON.

Pinned parameters are tool arguments fixed by the toolbox curator and stripped from the schema the model sees. They are force-merged at execution time, so the AI can never see or override them. You can pin a Google Drive tool to one specific folder, and the agent can only ever query that folder.

Toolboxes exposing more than about 30 tools automatically advertise just two meta-tools, search_tools(query) and execute_tool(name, arguments), so large toolboxes stay out of the model's context window. This behavior is configurable per MCP server.

Nobody ever handles a credential. Third-party credentials are held in a dedicated credential vault, encrypted at rest with AES-256-GCM, and are never returned by the API, not to users, not to admins, not to agents. Session, API, and MCP tokens are stored as keyed hashes and shown only once.

Yes. Custom connectors let you author a connector from a JSON config with base URL, auth, resources, and methods, or fork any of the 400+ public connectors, including its documentation. Forks track upstream lineage, so you can review and selectively pull upstream improvements later.

Self-hosted MCP servers multiply credentials, have no shared governance, and leave no audit trail. Elaichi centralizes connections with vaulted credentials, lets admins choose what each role can reach, enforces that at connect, advertise, and execute time, logs every tool call, and lets admins revoke or rotate any endpoint instantly.