AI Agent (MCP)

Human & AI action gateway — govern agent tool calls with the same engine as your admin back-office

⚡

Four steps — get a MAT from Console, save it via transcodes CLI, install transcodes-guard for your host, then prompt your agent. Risky shell and protected MCP calls are blocked until step-up MFA on Transcodes Auth.

Product: transcodes-guard · Token: member MCP JWT (MAT) from Console → @bigstrider/transcodes-cli · Node.js ≥ 20

Integration guides

Cursor Claude Code Codex Antigravity

Governance (agent perspective)

Topic	What it means for agents
Step-up Auth	Hook deny → human MFA → `poll_stepup_session_wait` → retry same command
RBAC	Token member’s role limits which MCP tools run
Audit Logs	Step-up MFA + narrow `guard_gate_decision` trail; optional SDK `trackUserAction`
Webhook	Session alert when step-up opens; audit alert on high-severity rows

Console setup and end-user SDK flows: Admin Back-office. Same RBAC matrix — only the actor changes (human vs agent).

When the hook denies (agent loop)

PreToolUse hook blocks the command — it did not run.
User completes WebAuthn on Transcodes Auth (URL in deny message).
Agent calls MCP poll_stepup_session_wait with the sid (blocks up to ~60s).
On verified, retry the same command. On rejected, stop — do not retry.

Details: Step-up Auth → AI agent (MCP)

Step 1 — Prepare your token

Option A — Setup Wizard (new projects)

When you create an Authentication cluster, the wizard finishes on Register Members and shows access tokens — Download as CSV.

Authentication Toolkit Setup Wizard — access tokens ready

Tokens are shown only once. Save them before closing the dialog.

Option B — RBAC panel (existing projects)

RBAC → Members → Get API Token for the member the agent should impersonate.

Transcodes Console — RBAC members & Get API Token

Step 2 — Save token (transcodes CLI)


# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/transcodings/transcodes-guard/prod/cli/install.sh | bash && transcodes install


# Windows (PowerShell)
irm https://raw.githubusercontent.com/transcodings/transcodes-guard/prod/cli/install.ps1 | iex; transcodes install


# After install — non-interactive / verify
transcodes set <token> -l dev
transcodes status

Stored at {{HOME_DIR}}/.transcodes/config.json. Hooks and the bundled MCP server read it automatically.

Without a saved MAT, hooks still deny risky commands but cannot start step-up — and nothing is written to Audit Logs.

Step 3 — Install transcodes-guard

Each host uses a different native install — pick your IDE:

Host	Guide
Claude Code	`/plugin marketplace add` + `/plugin install transcodes-guard@bigstrider`
Codex	`codex plugin marketplace add transcodings/transcodes-guard` + `codex plugin add …`
Cursor	Cursor Marketplace → Transcodes (bigstrider) (`/add-plugin`)
Antigravity	One-liner `install.mjs` (see guide)

Step 4 — Prompt your agent


What roles exist in my project? Show recent audit logs.
Before retiring a member, walk me through step-up verification.

Use /transcodes or $transcodes (where supported) for prompt-driven permissions — e.g. summarize audit logs, wire SDK sign-in/step-up, or ask whether a command would trigger step-up.

Next: Step-up Auth · Admin Back-office