Skip to content

v0.13.0

Latest
Latest

Choose a tag to compare

View all tags
@saimeda32 saimeda32 released this 20 Jul 20:07
v0.13.0
996fa76

Added

  • grantry install --gated makes grantry the agent's only credential source. It writes project-scope files that blank the ambient AWS_* variables in the agent's own shell and set GRANTRY_CALLER=agent, and adds a short steering note telling the agent to fetch credentials via the get_credentials MCP tool. It does not ban the aws command — the agent still runs aws/boto3, just only with the short-lived, policy-checked credentials grantry issues. Written per client where supported (Claude Code settings.json, the VS Code forks' terminal.integrated.env); Copilot CLI and Claude Desktop get the steering note only. Idempotent and scoped to the current directory.

    This is defense-in-depth, not a guarantee: it cannot remove ~/.aws/credentials, the SSO cache, or an instance role, and does not control network egress. For a hard boundary, run the agent with no ambient AWS access at all. The command says so plainly.

Assets 2
Loading