Why technology
Technology teams adopt AI agents first and furthest. Within a few months a team can have one agent in the editor, one in the terminal, one reviewing pull requests and one answering support questions — each with its own tokens, its own memory and its own idea of what happened.
The problems that follow are familiar: long-lived personal access tokens in agent configuration, agents that repeat each other’s work, nobody quite sure which agent merged what. Kroy puts one governed interface between the agents and the systems.
One state of work
Kroy State holds the working record for a task: the ticket, the branch, the decisions, the notes one agent left for the next. When Claude Code finishes and Codex reviews, or a person hands over to an agent overnight, the next worker starts from the record rather than from nothing.
Credentials stay with Kroy
Agents never receive GitHub tokens, database passwords or deploy hooks. Kroy holds them and exposes capabilities instead — github.pull_requests.create, postgresql.query.read, cloudflare.deploy_hook.trigger — each decided against the person, the agent, the delegation and the policy. Revoking an agent is one action.
Where AI helps, and where Kroy draws the line
| Area | AI can | Kroy boundary |
|---|---|---|
| Code changes | Create branches and open pull requests | Merge requires approval; branch protection still applies |
| Code review | Review a pull request with the task’s full context | Reads only the repositories granted |
| Releases | Prepare release notes from merged work | Release creation is approved by a person |
| Issue tracking | Triage, create and update Jira issues | Workflow transitions need approval |
| Internal data | Answer questions from named database queries | No schema changes; writes need approval |
| Website and docs | Draft content changes in Kroy Publish | Publication and rebuild follow approval |
| Support | Summarise tickets and draft replies | Drafts, not sends |
| Infrastructure | — | Secrets, DNS and cloud settings are excluded |
Your own systems
Private Connectors let a team bring an internal ERP, admin API or database into Kroy without waiting for anyone else to build it. The same permissions, approvals and audit apply to internal systems as to GitHub or Jira.
Sharing with customers and partners
Through Guest Access and Channels, a company can share a projection with a customer or partner — a status page, an integration guide, a shared project record — which they can use directly or through their own AI.
AI policy first
Even technical teams benefit from written rules: which agents are approved, what they may touch, who approves what. PolicyHQ helps a company write an AI policy and an access matrix.
Define the rules with PolicyHQ. Put them into practice with Kroy.
Frequently asked questions
Is this an MCP server? Kroy exposes an MCP server to AI clients that support it, but it is more than a proxy. It holds state, credentials, policy, approvals and audit behind that interface.
Can we use our own agents, not just commercial ones? Yes. Any agent that can authenticate to Kroy and call its interface is governed in the same way.
Does Kroy replace GitHub’s permissions? No. GitHub’s own rules, such as branch protection, still apply. Kroy adds a second layer that is specific to AI agents and the people they act for.
What happens when an agent tries something it is not allowed to do? Kroy refuses the request, tells the agent why, and records the refusal.