Quickstart: give an agent a Card

Give one agent a KIFF Card and watch KIFF check its calls against it. You connect a tool, issue the Card, point the agent at KIFF, and answer the first call that goes over the limit. No code, about ten minutes.

You need:

  • an account at app.kiff.dev (free);
  • an agent that can use a remote MCP server, such as Claude Code or Codex;
  • a remote MCP server at a public HTTPS address. Any public one works to try it.

Already run an agent in your own code instead, with a framework such as LangGraph or the OpenAI Agents SDK? See Connect an agent for kiff-guard. The Card works the same way.

1. Say who the account is for

The first time you sign in, KIFF asks Who is this account for?

  • For me: your own agents and tools. You see My Cards, My agents, Connected tools, Needs you and Activity.
  • For a company: the full workspace, with domains, contracts and API keys as well.

It changes what you see, not what KIFF does. You can change it later in Settings → Dashboard view.

2. Connect a tool

Open Connected tools and choose Connect a tool.

  1. Enter the server’s URL and, if it needs one, its bearer credential. KIFF lists the server’s tools. Nothing is saved yet.
  2. Choose the tool, the name your agent will see, and whether the tool only reads. If the tool takes a whole-number amount, choose it, so a Card can limit amounts as well as calls.

KIFF stores the credential encrypted and never shows it again.

Connected tools in KIFF Cloud: one connected read-only tool, with Give an agent a Card, Test, Replace credential and Remove.

A connected tool, from a KIFF test account.

3. Give the agent a Card

Add the agent on My agents if it isn’t there yet. Then, on the connected tool, choose Give an agent a Card:

  • Agent: the agent’s name.
  • Number of calls, per day, per 24 hours or per hour. With an amount argument, also the most per call and a total.
  • A call outside the Card: hold it for you to answer, or refuse it.
  • A held call waits: 10 minutes by default, up to 7 days.

Choose Issue the Card. The Card is in force at once, and its page shows the limit, what is used and what is left.

An issued Card: holder claude-e2e-agent, authority wiki_structure, 2 per rolling hour, 2 remaining.

The Card’s page right after it is issued, from a KIFF test account.

4. Point the agent at KIFF

Open the agent on My agents, go to its Tools tab, and choose Connect to the KIFF gateway. KIFF creates a key for this agent, which can ask for decisions and nothing else, and shows it once inside the configuration to paste.

The agent’s Tools tab: Use tools through KIFF, with the gateway URL, and the connected tools it can reach.

An agent’s Tools tab, from a KIFF test account.

For Claude Code, the configuration looks like this:

{
  "mcpServers": {
    "kiff": {
      "type": "http",
      "url": "https://mcp.kiff.dev/mcp",
      "headers": { "Authorization": "Bearer <the agent's key>" }
    }
  }
}

Keep the key out of anything you commit. If the agent can also reach the same tool directly, remove that access: the Card only binds calls that go through KIFF.

5. Use it, and go over the limit once

Ask the agent to use the tool. Calls inside the Card go through and return the tool’s own result. When a call goes over the Card:

  • nothing is sent to the tool;
  • the agent is told the call is waiting for you, with a link;
  • you get an email, and the call appears on Needs you;
  • in Claude Code, the chat also offers to open the link.

Open the link, signed in, and choose Approve once, Change the card to allow it, or Reject. The agent retries the same call and gets your answer. If nobody answers in time, the call is refused and nothing is sent. See Held calls and approvals.

What you have now

  • One Card that says what this agent may do with this tool, and how much.
  • A record of every call on Activity, and the Card’s statement of every draw and change.
  • A way to stop the agent: revoke its key on its Keys tab, or revoke the Card. Other agents keep their access.

Next