Overslash
an auth gateway for AI Agents
Last verified:
What is Overslash?
Overslash is an authorization gateway designed specifically for AI agents that sits between agents and external services. It handles secrets management, OAuth authentication, MCP (Model Context Protocol) integration, permission chains, human approvals, and authenticated HTTP execution. The core value proposition is that the agent never holds credentials directly—Overslash holds all keys and tokens, significantly reducing security risks when agents interact with external APIs.
Key features include agent identities organized in a tree structure where sub-agents inherit rules from parents (with the ability to narrow permissions), human approvals on tap where users approve or deny permissions when first requested with an
Overslash pricing
Pricing model: Freemium
Three pricing tiers: (1) Self-Hosted: Free forever at €0, run it yourself with all features, no gating, no license keys, no telemetry, unlimited agents/actions/integrations, local secrets vault, Elastic License 2.0. (2) Personal: Free for one user forever at €0, hosted Personal org just for you, all integrations, hosted backups & upgrades, personal audit log, all Cloud features for one user, no card required. (3) Team: €3.63/month per seat (€3 per seat + 21% VAT), includes everything in Personal plus multiple Team orgs, SSO (Google, GitHub, SAML), shared connections & secrets, audit log export, pooled usage with metered overages. OSS, research, or education users can email [email protected] for potential discounts.
Overslash pros
- Agent never holds credentials directly—Overslash holds all keys
- MCP-native integration works with Claude Code, Overfolder, OpenClaw
- Agent identities organized in hierarchical tree structure
- Sub-agents inherit parent rules with ability to narrow permissions
- Human approvals on tap with Allow & Remember functionality
- Permission chains bubble unknown scopes up to parents then humans
- Comprehensive audit log streaming every call, approval, and denial
- Audit log is searchable and exportable
- Centralized secrets vault with per-agent rotation and revocation
- No credentials ever touch the agent's context window
- First-class templates for 8+ major services (GitHub, Slack, AWS, etc.)
- Generic HTTP service template for any API with a URL
- Self-hosted version is completely free with all features
- Open source with Elastic 2.0 core and MIT services registry
- No telemetry or phone-home functionality
- Cloud personal org is free forever with no card required
- Team seating at affordable €3 per seat
- SSO support including Google, GitHub, and SAML for teams
- Shared connections and secrets across team members
- Written in Rust for performance and safety
Overslash cons
- Requires MCP-capable agent to use (limits compatibility)
- Team plans require paying per seat even for small teams
- Self-hosting requires your own infrastructure and maintenance
- VAT additional on team pricing (21% VAT mentioned)
- Limited to services with templates or generic HTTP API
- Human approval workflow can slow down agent automation
- Relatively new tool with smaller ecosystem than established alternatives
- No free tier for teams—only individuals get free cloud access
Frequently asked questions about Overslash
What is Overslash and what does it do?
Overslash is an authorization gateway for AI agents that sits between agents and the outside world. It handles secrets, OAuth, MCP, permission chains, human approvals, and authenticated HTTP execution. The agent doesn't hold keys—Overslash holds all credentials, enforces rules, and hands each service an authenticated, audited request.
Which AI agents are compatible with Overslash?
Any MCP-capable agent works with Overslash, including Claude Code, Overfolder, OpenClaw, Cursor, Open Interpreter, and your own custom agents. You connect the agent to Overslash once by pasting an enrollment skill block, and the agent will follow the skill and enroll itself under your Overslash account.
What services does Overslash integrate with?
Overslash has first-class templates for GitHub (PRs, issues, actions), Slack (messages, channels), AWS (S3, Lambda, IAM), Google Workspace (Drive, Gmail, Calendar), Notion (pages, databases), Linear (issues, cycles), Vercel (deploys, envs), and PostgreSQL (read, write, migrate). It also supports any HTTP API through a generic service template. More integrations like Stripe, Zendesk, Jira, and Intercom are coming soon.
How are agent identities structured?
Every agent gets an identity with a parent and a blast radius. Sub-agents inherit rules from their parent until you narrow them. This creates a tree structure where permission chains allow unknown scopes to bubble up from sub-agents to parents, and parents bubble to humans when needed.
Where are credentials stored and how secure are they?
Overslash holds all credentials in a centralized secrets vault. Client IDs, tokens, and signing keys are stored in one place with per-agent rotation and revocation capabilities. No credentials ever touch the agent's context window, significantly reducing security risks. The self-hosted version includes a local secrets vault.
What is included in the audit log?
The audit log records every call, every bubble-up, every denial, and every approval. It streams in real-time, is searchable, and is exportable. Each entry includes the agent identity, permission requested, service, timestamp, and action taken. The personal org includes a personal audit log, while teams get audit log export capability.
How do I self-host Overslash?
Clone the repository from GitHub (https://github.com/overfolder/overslash), run 'make install', then 'overslash web'. It will be ready on http://localhost:7171 with a signing key generated and audit DB initialized. You then paste the enrollment link into your MCP client. The gateway core is Elastic 2.0 licensed with no telemetry.
What is the difference between Personal and Team orgs?
Personal org is free forever for one user with all integrations, hosted backups & upgrades, personal audit log, and all Cloud features. Team org costs €3 per seat and includes everything in Personal plus multiple Team orgs, SSO (Google, GitHub, SAML), shared connections & secrets across team members, audit log export, and pooled usage with metered overages.
What licensing does Overslash use?
The gateway core is licensed under Elastic 2.0, while the services registry (the part the community contributes to) is MIT licensed. There is no telemetry and no phone-home functionality. The code is written in Rust and SvelteKit, and you can read it, fork it, and run it openly.