Apono MCP

Just-in-time access to your infrastructure and SaaS tools for AI agents, governed by Apono.

@apono-io/apono-mcp runs the Apono Agentic Gateway: a local MCP server for Claude Code, Cursor and Claude Desktop. The agent asks the gateway for what it needs. Apono grants scoped, time-limited access through your existing access flows, the gateway enforces your trust policies on every tool call, and every call is audited.

• No standing credentials. The agent never holds a long-lived secret. Apono issues credentials per request and revokes them when access expires.
• Trust policies on every call. Each tool call is classified by intent (read, write, delete, ...) and allowed, denied, or sent to a human for approval.
• One server, many targets. Databases, cloud accounts, Kubernetes and SaaS tools that your Apono admin connected, all behind one MCP server.

What's new in v0.2.53

✨ Improvements

• Every install now includes the licenses of the open source code inside the gateway - The release archives carried only the gateway's own license. Each archive and Linux package now includes a credits.html page with the full license, notice and patent texts of every open source library compiled into the gateway, and of Go itself. The npm package saves the page to ~/.local/share/apono-agentic/ and prints its path when it installs a version.
• Each stable release is also published as a container image that holds every platform's build - Partners that package the gateway into their own apps had to collect the builds one platform at a time. Each stable release now also publishes one container image with the macOS, Windows and Linux archives and their checksums, for docker pull. The Linux builds in that image can run inside a desktop app host.
• A tool call that ended because the caller stopped is no longer reported as a gateway error - A tool call whose caller stopped waiting was recorded with the same generic internal error as a tool server that had broken, so a session's activity could not tell the two apart. Such a call now carries its own reason, leaving the generic error for real failures.
• An access request now takes its duration from the access policy - An agent that asked for more access time than the policy allowed received an error instead of access, and nothing in the tool surface stated that limit. create_access_request no longer takes a duration: the access policy sets it, and on an account that requires an explicit duration the gateway asks for ten minutes, never more than the policy allows.

🛡️ Reliability

• A failed call to a connected tool now records why it failed - A call the gateway runs against a connected tool recorded only that it failed, so a caller that stopped waiting could not be told from a tool that broke. Each failure now carries its cause, which makes a recurring problem identifiable instead of hidden among every other failure of the same tool.
• A refused tool call now records why it was refused - A refused call recorded which tool failed but not the reason, so one cause could not be told from another when a problem recurred. Each refusal now carries its cause, which makes a repeating failure identifiable instead of indistinguishable from every other refusal of the same tool.
• A session that lost its credential now recovers from a credential another session already refreshed - When one session refreshed a rejected credential, other sessions of the same user kept the old one and failed every call until they restarted. A session now picks up the refreshed credential and retries the call.
• A gateway that cannot start a tool server no longer rotates credentials other sessions are using - When a managed tool server failed to start, usually because its command was missing on the machine, the gateway treated the failure as a rejected credential and rotated it. Other sessions of the same user then lost access until they restarted. The gateway now leaves the credential alone when the failure happened before the tool server used it.

Requirements

• Node.js 16 or later, for npx.
• An Apono account. Ask your Apono admin to enable Agentic access for you.

Setup

1. Log in to Apono

npx -y @apono-io/apono-mcp@latest login

This opens your browser to sign in. You log in once per machine; the gateway refreshes the session on its own.

2. Add the gateway to your agent

Claude Code

claude mcp add apono -- npx -y @apono-io/apono-mcp@latest --agent-type claude-code

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "apono": {
      "command": "npx",
      "args": ["-y", "@apono-io/apono-mcp@latest", "--agent-type", "cursor"]
    }
  }
}

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "apono": {
      "command": "npx",
      "args": ["-y", "@apono-io/apono-mcp@latest", "--agent-type", "claude-desktop"]
    }
  }
}

Restart the agent after you change its configuration.

3. Ask for what you need

Ask the agent in plain words, for example "query the orders table in the staging database". The agent finds the resource through Apono, requests access, and runs the call once access is granted. When a call needs approval, the approver gets a request and the agent waits for the decision.

Versions

@latest always runs the newest stable gateway. To pin a version, name it instead, for example @apono-io/[email protected]. On first run the package downloads the matching gateway binary to ~/.local/bin, and later runs reuse it.

Support

Contact your Apono admin, or reach Apono support at [email protected].