Skip to main content
Passport sits between an agent and the work app it wants to use. It keeps the app credential, checks access and Safety, makes the call, and records the outcome.

​
The five things to know

​
Workspace

A workspace is your team’s private space in Passport. It holds people, apps, settings, and Activity. Workspaces are isolated from one another, and you can switch if you belong to more than one.

​
Apps

An app is something your agent can use through Passport, such as GitHub, Linear, Stripe, or Notion. Open Apps to browse, connect, and manage them. Some apps connect through MCP. Others use a reviewed API integration. Passport gives both the same connection, access, Safety, and Activity experience, so most people do not need to care which technology is underneath.

​
Agents

An agent is where you use AI: Claude, Cursor, ChatGPT, VS Code, Codex, Passport CLI, or another MCP-compatible product. Open Agents to add one, see its connection status, disconnect it, or choose which available apps it can see. On Enterprise, admins see every agent in the workspace under Inventory, next to connections that scans found outside Passport.

​
Access

Access answers one question: what may this person do with this app?

Full

Read and write tools are available.

Read-only

Write tools are hidden from the agent.

None

The app is not shown to that person.
Pro and Enterprise admins can set access for the workspace, a team, or a person. A more specific choice wins. A person’s agent-level app selection can narrow access further, but can never grant more.

​
Activity

Every call through Passport creates an Activity record with the person, agent, app, action, outcome, and timing. Members see their own records. Pro and Enterprise admins can review the workspace-wide log on the same Activity page.

​
What happens during a call

1

Identify the person and agent

Passport checks the signed-in identity and the connection being used.
2

Apply access and Safety

Apps or actions that are not allowed are hidden, blocked, or held for approval.
3

Inspect the request

Guardrails check outgoing arguments before Passport contacts the app.
4

Call the app

Passport uses the connected account on the person’s behalf.
5

Inspect and record the result

Guardrails check the result, then Passport writes Activity and returns the safe response.

​
People, teams, and automation

  • Admins manage the workspace and its rules.
  • Members connect agents and use the apps available to them.
  • Agents are the AI tools connected to Passport, such as Claude Code, Codex, or Cursor.
  • Automation credentials connect scripts and CI through Passport CLI.
  • Teams let Pro and Enterprise admins apply access and team setups to a group instead of one person at a time.
Deactivating a person revokes their sessions, agents, and connected accounts immediately.

​
Advanced building blocks

  • A bundle combines a curated set of tools from several apps behind one connection.
  • Tool discovery modes control how a large tool catalog is presented to an agent.
  • Managed API integrations connect reviewed provider APIs through the same Passport gateway.
Most people should add https://passportmcp.com/mcp. It connects to your workspace when you sign in. For CLI agent keys, set PASSPORT_ENDPOINT to the workspace URL (/w/ws_…/mcp). See Passport CLI.