The open-source access layer for AI agents

Give agents access,not secrets.

The credential never leaves the vault. The agent never holds it.

Limen brokers short-lived, scoped, fully-audited sessions into your infrastructure: SSH, RDP, databases, internal APIs. An agent does the work without ever seeing a secret.

Start self-hosting See how it works
$ curl -fsSL https://limenhq.sh/install | sh
limen · ephemeral sessionbrokered
agent → limen request access db-prod-02 scope=read ttl=10m reason="reconcile orders" limen → policy role analyst-agent · target allowed ✓ · recording on limen → agent session #a3f9 open · credential •••••••• (never sent to the agent) agent → db SELECT count(*) FROM orders; → 48,213 limen t+10m · TTL reached · session closed · access revoked · log signed ✓

One broker in front of everything your agents and engineers need to reach

SSHRDPVNCPostgreSQLMySQLMongoDBRedisKubernetesMCP

The bottleneck isn't capability. It's access.

To do real work, an agent has to reach real systems, and handing it a long-lived credential is a breach waiting to happen. The fix isn't another model. It's a broker that grants access without distributing secrets.

One request. A session that expires.

The credential lives in Limen and never leaves it. When an agent needs access, Limen opens the connection and injects the secret into the session, so the agent operates on the target while the secret stays behind the threshold.

requester
Agent or human
Asks for a specific target, with a scope, a TTL and a reason, over MCP or the CLI.
Limen
  • evaluate policy
  • open + inject credential
  • record the session
  • expire & revoke
secret stays in the vault
never crosses to the requester
target
Production
Hosts, databases and APIs, reached directly or across a private network via an Edge Connector.
01

Request

The agent asks for access: which target, what scope, for how long, and why.

02

Policy

Limen checks the requester, target and context against your rules before anything opens.

03

Session

Limen connects and injects the credential. The requester gets a live session, not the secret.

04

Revoke

Every action is recorded and signed. At the TTL, the session closes and access is gone.

The broker

One layer between every agent and everything it can reach.

The policy decides. The broker opens the session and injects the credential. The recorder keeps the proof. Nothing standing, nothing shared.

Policy engine

Who can reach what, from where, and for how long. Evaluated before anything opens.

Audit & replay

Every request and keystroke signed and replayable, with secrets redacted from the record.

Access, brokered and on the record.

Every session, on the record

The same broker your engineers use

Keystrokes logged, secrets redacted

On-call access that expires with the incident

Answer an audit with a replay, not a spreadsheet

Contractors get the session, never the key

Access to what you already run.

One broker in front of the systems your agents and engineers actually need. Nothing to install on every box, no credentials copied into a config.

SSHshell

Brokered terminal sessions with credential injection and full keystroke recording.

RDP · VNCdesktop

Remote desktop in the browser. The operator drives the session, never sees the password.

Databasessql · nosql

Postgres, MySQL, MSSQL, MongoDB, Redis. Scoped read or write, with the query trail logged.

Internal APIshttp

Reach services behind your perimeter without shipping tokens into an agent's context window.

Private networksedge

Edge Connectors tunnel into a private network. The credential never leaves your side.

Humans toopam

The same broker your on-call engineers use for privileged access. One policy, one trail.

Where access is the hard part.

Banks, carriers, hospitals, grids and warehouses run the systems agents actually need to reach, and the ones nobody hands a password to. Limen brokers the session, so the work gets done and the credential stays in the vault.

Banking

Reconciliation agents that never hold a database password

Reconciliation, fraud review and batch fixes all end in the same place: a production database full of customer records, reached with a standing credential that sits in a runbook, a config file or an agent’s context window. Limen injects that credential into a scoped, expiring session. The agent runs the query, the secret never leaves the vault, and every statement lands in a signed log with secrets redacted.

Read-only, 10-minute grants for nightly reconciliation. No standing database credentials for agent work.

Agents are first-class users.

An agent requests access the same way it calls any other tool, over MCP. It gets back a session handle, not a secret. Least-privilege by construction: it reaches only what your policy allows, only for as long as you grant.

agent · MCP tool call
// the agent asks Limen for access
limen.request_access({
  target: "db-prod-02",
  scope:  "read",
  ttl:    "10m",
  reason: "reconcile nightly orders"
})

// → a session, never a credential
{ session: "#a3f9",
  expires_in: "10m",
  status: "granted" }

Access you can trust to an agent.

Access without secrets

The credential is injected into the session and never handed to the requester. Nothing to leak, log, or leave in a context window.

Ephemeral by default

Every grant carries a scope and a TTL. When it expires, the session dies and access is revoked. No standing credentials.

Every session recorded

Requests, commands and keystrokes are logged and signed, with optional full replay. Secrets redacted from the record.

Open source, self-hosted

Limen runs inside your trust boundary. Nobody routes production access through someone else's cloud, including ours.

How it's different. Teleport and StrongDM broker access for humans, from the cloud. The non-human-identity platforms govern which machines exist, but don't broker the session itself. Limen is the open-source, self-hosted broker built agent-first: the session and the policy in one box you run.

Open core. Free to run, forever.

Community · AGPLv3

The broker

Free · self-hosted · unlimited
  • Credential vault & session broker: SSH, RDP, VNC, databases
  • Ephemeral scoped grants & signed audit log
  • MCP endpoint for agent access
  • Edge Connectors for private networks
Enterprise

For the org

The parts you need at scale
  • SSO / SAML / SCIM provisioning
  • Full session recording & replay, granular RBAC
  • SIEM streaming & multi-region HA
  • Managed cloud & support SLA

Let your agents reach production, safely.

Clone the repo, run one command, broker your first session in minutes.

Start self-hosting
humans

Self-host it

One command on your own box. Your secrets never leave your infrastructure.

curl -fsSL https://limenhq.sh/install | sh
agents

Point to MCP

Give your agent the Limen MCP endpoint. It requests access as a tool call.

limen mcp --serve
builders

Read the code

Open source under AGPLv3. Architecture, policy model and API in the docs.

github.com/limenhq/limen