A person is the account holder. You own two things: your connections, entered once, and your toolbox, authored once. However many harnesses you run, a credential is typed once and a tool is written once. An agent is one harness connection to Graft. It authenticates with a token of its own and holds exactly two things: a scope, the connections it may use, and a working set, the authored tools currently promoted into its list. Expansion and contraction happen per agent. Credentials and code do not. Hermes on your laptop and OpenClaw on a server are two agents over one toolbox. They may hold the same tool in their working sets with different approval states, because approval is per agent, per tool.

​
The token

An agent made in the console has a bearer token, prefixed grft_, shown once when the agent is created. Graft stores only its hash and prefix; the prefix is what the console shows afterwards so you can tell two agents apart. The harness carries the token as a static Authorization: Bearer header on every request. An agent made by connecting Claude or ChatGPT has no static token. The product holds OAuth tokens for it, renews them itself, and the console shows the product’s name beside the agent instead of a prefix. Either way one connection is one agent. Tokens are per agent so that one leak revokes one agent. Revoke token (or Revoke agent, for one a product connected) on the agent’s page stops that harness at the MCP endpoint at once: a request carrying any of its tokens is refused before any MCP handshake. The agent’s row, its working set and its history stay as your records. To reconnect a harness, create a new agent; a product asks you to connect again.

​
What the agent decides, and what you decide

The agent decides what is needed: which tool to look for, which connection to propose, what acquire should build. You enter credentials yourself, on Graft’s form and never through the agent, and you answer approvals. The first real write a tool makes goes through your agent invoking the published tool, never through Graft’s model.

​
What is per agent

Revoking a connection therefore affects every agent at once, and every tool bound to that vendor asks again after reconnection. Revoking an agent affects nothing but that agent.

​
Try it