Intramedial is in restricted beta. At sign up or sign in, you have to provide the beta tester password you received or request one at preview@intramedial.com. Thank you.
One REST API with enforcement points for MCP, GitHub and SaaS, behind one admission check. Declare an intent from an agent, CI or your backend, and Intralock admits it under a lease or refuses with a reason.
Reads the actor, resource and verb, applies the mandates and leases in force, and answers allow or deny with a reason. The same check at every enforcement point.
How to read this directory
Each entry says what exists today. Where something is not published yet, we say so and show the way that works now.
Hosted service
Runs on Intramedial. Send a request to the route and authenticate.
Documented recipe
No package needed. The docs give steps or code that call the API directly.
Not published yet
The source is complete but not released. Use the alternative shown on the card.
Manifest only
A description file is published for hosts that read it. We do not document install steps.
Start here
Intralock · Leases · Parley · Fleet Map
A Trustvice Product
Agents act when the plane says yes, and the record says why.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
Every admission and refusal is appended to the ledger with its actor and reason.
Offline bundles
A signed bundle of the ledger verifies offline against the public key. No account needed.
Quick start
Three ways to start
Put the MCP gateway in front of a server, gate GitHub writes, or issue short-lived AWS credentials. Each takes a few lines.
MCP gateway
Hosted service
Sits in front of your MCP servers. It admits each tool call through Intralock and, for a registered upstream, forwards it under the workspace mode: observe, advise or enforce.
The enforce route only decides; the call route forwards it
Up to 50 upstreams, each with an 8 second timeout
Reply screening is a heuristic on text, not a guarantee
bash
# 1. register the upstream with POST $ACP_URL/api/v1/acp/mcp/upstream-add
# 2. send each tool call to the gateway
curl -sS -X POST "$ACP_URL/api/v1/acp/mcp/call" \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" -H "Content-Type: application/json" \
-d '{"actorDid":"did:web:acme.example:agent:support","upstream":"<name>","tool":"fs.write","args":{}}'
Asks Intralock whether an agent may write to a repository, then posts the answer on the commit as the intramedial/acp check run, or as a commit status.
Needs a GitHub App or token to show on the commit
The check blocks a merge only if branch protection requires it, so set that
Admission is per repository, not per branch or ref
bash
# the verdict appears as the intramedial/acp check run
curl -sS -X POST "$ACP_URL/api/v1/acp/github/enforce" \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" -H "Content-Type: application/json" \
-d '{"repo":"acme/payments","actorDid":"did:web:acme.example:agent:billing","sha":"<commit sha>","action":"write"}'
Mints short-lived AWS credentials for an agent that holds a live lease on the role. It never outlasts the lease, and the ledger holds no keys.
Agents hold no standing cloud keys
A credential already issued lives until its own expiry; keep leases short
Lifetime is the lease remainder, up to one hour, never longer
bash
# the agent must hold a live lease on this exact role ARN
curl -sS -X POST "$ACP_URL/api/v1/acp/iam/assume" \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" -H "Content-Type: application/json" \
-d '{"roleArn":"arn:aws:iam::123456789012:role/deploy","actorDid":"did:web:acme.example:agent:release","webIdentityToken":"eyJ…"}'
Plans, then applies, an import from a LangGraph, CrewAI, AutoGen, Okta, Entra, Terraform or Kubernetes export. It reads only what you post.
bash
curl -sS -X POST "$ACP_URL/api/v1/acp/onramp/plan" \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" -H "Content-Type: application/json" \
-d '{"source":"langgraph","namespace":"acme.example","export":{"nodes":[{"id":"planner"}],"edges":[]}}'
# then POST .../onramp/apply with the plan it returns
Take the same lease from a GitLab job, with the same curl calls as the GitHub step. A recipe, not a GitLab integration: Intramedial never contacts GitLab itself.
Issues a short-lived credential for a leased warehouse resource, or refuses when it is not set up.
HTTP
POST /api/v1/acp/coordination/lease
{ "resource": "imd://warehouse/snowflake/<account>/<DATABASE>/<SCHEMA>",
"actorDid": "did:web:acme.example:agent:analyst" }
POST /api/v1/acp/iam/warehouse
Takes pull request, check, workflow run and merge group events at github/ingest. A webhook write gets a pending status until an approver confirms it.
HTTP
POST /api/v1/acp/github/ingest
X-GitHub-Event: pull_request
# pull_request, check, workflow_run and merge_group events enforce;
# push events are recorded only
Reads the ledger for bursts and silence in lease and credential issuance. Nothing runs it on a schedule, so call it from yours.
bash
curl -sS "$ACP_URL/api/v1/acp/watchdog/check" \
-H "Authorization: Bearer $INTRAMEDIAL_KEY"
# run it from your scheduler; send findings to your own alerting
Seals a range of the workspace audit log into a Merkle-rooted bundle signed with the region's Ed25519 key. The public key is served at a well-known endpoint, with no login.
bash
curl -sS -X POST $ACP_URL/api/v1/ledger-bundles/snapshot \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" -H "Content-Type: application/json" -d '{}'
# public key: GET /.well-known/ledger-bundles-keys.json
Checks a bundle or audit chain with the WebCrypto code the runtime uses, with no network. The @intramedial/verifier package is in the repo; we cannot confirm an npm release.
bash
# built from the verifier/ directory of the repository
intramedial-verify bundle.json --keys keys.json
These files are published but not all filled in. The DID document and SPIFFE bundle hold placeholder keys, and the A2A roots list is empty. The MCP, agent-card and OpenAPI files still describe an older tool set, not Intramedial's, so do not rely on them.
Agent frameworks and platforms
Agent platforms
Reachable from any agent that speaks HTTP or MCP
These frameworks and platforms can call the Intramedial REST API, or sit behind its MCP gateway, in the same way as any other client. Select a name to open its guide.
Showing a name or logo here means only that the product can reach Intramedial over HTTP or through the MCP gateway. It does not mean that its owner endorses, sponsors or partners with Intramedial.
Build your own
Raw API
No integration for your stack? Call the API.
Intramedial is plain JSON over HTTPS. Every integration is a request that declares an intent, and the answer is allow or deny with a reason.
MCP and REST
MCP calls via gateway
A2A trusted roots
