Give an AI agent useful work across your stack
Runner gives your AI agent an OAuth-protected MCP connection, checks the caller's permission on every call, holds each answer to the shape its tool declares, and gives admins a stop control from the whole workspace down to a single tool.
Built into Runner
- An MCP endpoint your agent connects to, with OAuth
- Permissions checked fresh on every call, never from a cached copy
- Every tool is graded, with consequential work routed to a person
- Each answer checked against the shape its tool declares before it goes back
- A stop control for the workspace, a project, one tool or one person's connections
Worth knowing
What an agent may call follows the permissions of the teammate it signed in as, checked again on every call, and anything irreversible or destructive stays off the list by design. A tool that changes a record is served only once it declares the go-ahead it needs, the evidence it carries and how it is undone, and that go-ahead is given by a person elsewhere, never over the connection — these are the controls around an agent, not an agent deciding for you.
Connecting an agent is an OAuth approval with a project list
An agent reaches Runner through OAuth, and PKCE is required of every client, using the SHA-256 method only. There's no API key to generate, paste into a config file and forget about.
The person approving the connection sees their organization's projects, each ticked, and can narrow the list before saying yes; approving with none ticked is refused. From then on every request names one project and is turned away unless that project was on the list, and the organization is read from the project on the server rather than taken from the agent.
Nothing about the connection is remembered between requests. What the agent may do is worked out again each time, from the role the person who connected it holds on that project right now, so a revoked grant stops on the next request and a changed role shows up the next time the agent asks.
Every call runs the same checks, and any one of them ends it
A tool call has to get past all of these before anything comes back. A request that's too large or too deeply nested is turned away before its token is even read, and the stop controls are checked ahead of the permission check on the call itself.
- A valid token, and a project that was on the approved list.
- No stop in force for the workspace, the project, the person or the tool.
- A role that carries this tool's permission on this project, checked fresh.
- Input that matches the tool's own schema — a field it doesn't declare is refused, not quietly dropped.
- For anything that commits a change, a person's approval of this exact call.
- An answer that matches the shape the tool declared — otherwise the whole call stops.
The short version
Nothing on this list is a flag the agent sets, and nothing on it is read from an earlier request.
The stop is sized to the problem, and every move needs a reason
Owners and admins can stop agent traffic for the whole workspace, one project, one person's connections, or calls to a single tool. Stopping takes a written reason and so does releasing. A stop can carry an expiry, after which it lifts on its own and its record stays.
There's no allow record in the model, only stops, so nothing narrower can reopen what a broader stop closed. A stopped workspace doesn't even get its tool list back. And a stopped agent receives the same words whatever the scope, so a stop on one project never tells anyone that project exists.
Questions buyers ask
Does Runner's MCP server need an API key?
No. An agent connects with OAuth, PKCE is required of every client using the SHA-256 method, and the person approving the connection picks which projects it may reach. A request for any other project is refused.
Can an AI agent send email, move a deal or delete records through Runner?
No. Nothing an agent is offered over the connection sends a message, changes a deal or deletes a record. Destructive or wide-reaching tools are never served at all, and a tool that commits any change runs only after a person has approved that exact call in Runner — change one argument and it needs a fresh approval.
Do Runner's MCP search tools return message content or meeting notes?
No. They answer small on purpose: conversations come back as a label with no messages, meetings as when and in what state with no attendees or notes, campaigns as status and counts with no content, and accounts as an id and a name.
Can I stop agent access without shutting everything down?
Yes. An owner or admin can stop calls to one tool, one project, or one person's connections and leave the rest of the workspace running. Each stop takes a reason, and you can set it to lift itself at a time you choose.
What does an agent see when it asks for something it isn't allowed?
The same generic answer it gets for something that doesn't exist. A tool it wasn't granted and a tool name it invented get identical replies, and so do a revoked token and one that never existed, so nobody maps your workspace by guessing.
Does a permission change take effect straight away?
Yes, on the agent's next request. Permissions are worked out again every time from the person's current role and the connection's project list, and no session holds on to the old answer.
Use what already works
Connect an MCP client that signs in with OAuth and names its product on each request. It signs in as one of your teammates, and every call is checked against that person's permissions at the moment it runs, so a change of role applies to the next call.
How teams often buy this job
Usually bought as Composio, Zapier, Pipedream or n8n.
ComposioZapierPipedreamn8n
Trademarks of their owners. No affiliation or endorsement.