Executor is an MCP gateway.

What we think

Every agent wants its own copy of every integration. You set up GitHub in Claude Code, then again in Cursor, then again in Codex. Same OAuth, same API key pasted in five places, and none of them agree on what a tool is allowed to do.

Your tools should belong to you, not to whichever agent you opened today. Executor turns everything into one shape: a name, an input, an output. An MCP server, an OpenAPI spec, and a GraphQL API all look the same to the agent, so you connect once and every agent gets it.

And the safe way has to be the easy way, or nobody does it. Executor knows a GET from a DELETE, asks before the scary ones, and runs everything in a sandbox where the model never sees a raw token.

Thousands of tools, one in the prompt

The model only ever sees one tool. Executor looks up what it needs when the code asks for it, so you can connect fifty services and the prompt stays the same size. Toggle a few below and watch the numbers.

Without Executor: 1,640 tools, about 278,800 tokens. With Executor: 1 tool, about 1,044 tokens.

Context window

Lower is better

Without Executor1,640 tools · ~278,800 tok

With Executor1 tool · ~1,044 tok

GitHub720 toolsStripe510 toolsJira240 toolsSentry170 toolsLinear130 toolsGmail95 toolsNotion80 toolsSlack70 tools

Without Executor

1,640 tools · ~278,800 tok

"You are a helpful assistant.

Your tools are:

createIssue()
listPullRequests()
mergePullRequest()
createRelease()
addLabels()
createBranch()
getCommit()
// + 713 more GitHub tools
createCharge()
createCustomer()
createRefund()
listInvoices()
createSubscription()
capturePaymentIntent()
listPayouts()
// + 503 more Stripe tools
createIssue()
transitionIssue()
addComment()
assignIssue()
listSprints()
createProject()
searchIssues()
// + 233 more Jira tools
listIssues()
resolveIssue()
listEvents()
getProject()
muteIssue()
createRelease()
listAlerts()
// + 163 more Sentry tools
..."

With Executor

1 tool · ~1,044 tok

// the only tool your client sees: "execute"

Execute TypeScript in a sandboxed runtime with access to
configured API tools.

## Workflow

1. const { items } = await tools.search({ query });
2. const path = items[0]?.path;
3. const details = await tools.describe.tool({ path });
4. const result = await tools[path](input);

## Available connection prefixes

- github.org.main: Production GitHub
- stripe.org.main: Live Stripe account
- jira.org.main: Team Jira
- sentry.org.main: Production Sentry

Safe by default

Policies come from the source.

GET versus DELETE for OpenAPI, destructiveHint for MCP, mutations for GraphQL. Agents run the safe calls on their own and ask before the rest. You can override any tool.

Secrets never reach the model.

Calls run in an isolated JavaScript sandbox. Credentials are attached host-side at call time and never enter the sandbox, the agent, or the model's context.

Set up once, whole team has it.

Admins add workspace connections everyone shares. Individuals add their own. New teammates get the catalog on day one, with the same policies, and you can block a tool for the whole workspace in one click.

Open source, so you can check.

Cloud stores credentials in WorkOS Vault. Local and self-hosted keep them on your machine, or in 1Password. The whole thing is on GitHub if you would rather read the code than take our word for it.Source ↗

Run it where you want

Same tools, same policies, four ways to run them.

Not an agent? Cloud also has an HTTP API with user and workspace keys, so a script or a service can call the same tools with the same policies.

Pricing

Cloud is free for up to three people. Team is $15 per member per month. Running it yourself is free.

See pricing ↗ · Talk to us about Enterprise

Writing

• Why MCP had growing pains ↗
• All posts ↗

About

Executor is backed by Y Combinator. It started because I wanted my own agents to reach my accounts in a way that was not scary. Most setups make you choose between locked down and useless, or wide open and risky. I wanted a third option.

Rhys SullivanFounder. Say hi on X, @RhysSullivan ↗

Discord ↗