A Gatekeeper That Makes Agents Ask Before They Act

What it does Corsair sits between your agent and third-party APIs like Gmail, Slack, or GitHub. It resolves credentials internally so the agent never sees API keys, and it routes every tool call through a permission layer that can block or queue destructive actions for human approval.

The interesting bit The permission model is the standout. You set per-integration modes—open, cautious, strict, or readonly—and Corsair intercepts calls accordingly. Under cautious mode, an agent trying to send an email gets paused while Corsair generates a public review link; nothing leaves the server until you explicitly approve.

Key highlights

• Agents never handle raw credentials; secrets are resolved at call time via envelope encryption.
• Four permission modes per integration, with endpoint-level overrides available.
• Built-in multi-tenancy isolates credentials, data, and permissions by tenant.
• Typed, signature-verified webhook handlers route to a single endpoint.
• Works alongside direct SDK calls when you need logic Corsair doesn’t cover.

Caveats

• The README doesn’t list supported integrations; you’ll need to check external docs for the current plugin roster.
• It is designed for MCP-compatible agent workflows, not as a general-purpose API gateway.

Verdict If you’re building agent workflows that touch production SaaS tools, Corsair offers a permissions and credential isolation layer that homegrown wrappers usually skip. If your agents stay in a sandbox or you enjoy hand-rolling OAuth scopes, pass.