{"slug": "give-your-ai-sub-agent-a-budget-not-your-keys", "title": "Give your AI sub-agent a budget, not your keys", "summary": "A developer has released Grantor, an MCP server that gives AI sub-agents cryptographically bounded permissions instead of full access to the parent's credentials. The tool, available via npx, allows granting limited tool access with usage caps and time-to-live, and supports delegation and revocation through a public smart contract on Base. It aims to solve the problem of sub-agents inheriting excessive privileges in frameworks like CrewAI, LangGraph, and AutoGen.", "body_md": "Spawn a sub-agent in CrewAI, LangGraph, AutoGen, or a Claude sub-agent\n\nsetup and check what it actually holds: your credentials. The parent's\n\nkeys, at full scope, forever. The throwaway agent you created to summarize\n\nthree PDFs can call every tool your orchestrator can, and the only\n\n\"revocation\" is rotating keys everywhere at once.\n\nWe accept this because handing a child *less* than everything has been\n\ngenuinely hard: OAuth scopes need an authorization server someone runs;\n\nrole systems need an admin; API keys don't subdivide. So the ecosystem\n\nquietly standardized on \"copy the parent's environment\" and moved on.\n\nHere's a different shape, as an MCP server you run locally:\n\n```\nnpx -y @grantor/mcp serve\n# or wire it into Claude Code:\nclaude mcp add grantor-mcp -- npx -y @grantor/mcp serve\n```\n\nThat gives any MCP-speaking framework five tools. The whole model fits in\n\none transcript:\n\n```\ngrant    {tools: [\"search\",\"fetch\"], max_uses: 20, ttl_secs: 3600}\n         → {child_id: \"…\", sub: \"…\"}          # a bounded child identity\n\ncheck    {child_id, tool: \"search\"}\n         → {allow: true, remaining_uses: 19}   # gate EVERY action on this\n\ncheck    {child_id, tool: \"write\"}\n         → {allow: false, code: \"CapabilityDenied\"}   # not granted → denied\n\ndelegate {parent: child_id, tools: [\"search\"], max_uses: 5}\n         → {child_id: \"…\"}                     # a narrower grand-child\n\nrevoke   {child_id}\n         → revoked                             # authority withdrawn\n```\n\nThe interesting properties are in what you *can't* do:\n\n`delegate`\n\nfor a tool the\nparent doesn't hold is refused before anything is signed. Asking for\nmore uses or a longer expiry silently clamps to the parent's bound.\nThis isn't a policy file the framework consults — the delegation chain\nis cryptographically signed link by link, and verification re-checks the\nnarrowing math on every `check`\n\n.`max_uses: 20`\n\nmeans the 21st `check`\n\nis\ndenied with `UsesExhausted`\n\n, not logged-and-allowed.`revoke`\n\nbumps a revocation\nepoch on a public smart contract; every capability in that cohort fails\nits next `check`\n\nno matter which process holds it.And the part that makes this different from every \"policy engine\" you've\n\nseen: **there is no server.** No authorization service, no policy backend,\n\nno vendor API in the hot path. Authority anchors to a public registry\n\ncontract on Base; verification is a local computation plus one `eth_call`\n\nthat any RPC provider can serve. The broker runs on your machine, next to\n\nthe framework it guards, and holds the child keys so your agents never see\n\nkey material at all.\n\nThe zero-setup run above works because the package ships pointed at a\n\nlive shared sandbox tenant on the production registry — real chain, real\n\nverification, publish-on-purpose demo key that controls nothing outside\n\nthe sandbox. Honest limits: it's an unaudited developer preview, the\n\nsandbox broker self-issues its anti-replay challenge (it's holder and\n\nverifier in one process), and use-metering is local to the broker.\n\nProduction is one contract call away (USDC on Base, no signup — your\n\nagent can even read the machine-readable onboarding manifest and do it\n\nitself). Docs: [https://chaingrantor.com/docs/guide/mcp-broker](https://chaingrantor.com/docs/guide/mcp-broker)\n\n**MCP standardized what agents can\ncall. A2A standardized how they talk. Nobody standardized what they're\nallowed to do — that's the layer this fills.**", "url": "https://wpnews.pro/news/give-your-ai-sub-agent-a-budget-not-your-keys", "canonical_source": "https://dev.to/grantor/give-your-ai-sub-agent-a-budget-not-your-keys-2e7h", "published_at": "2026-08-21 19:06:18+00:00", "updated_at": "2026-08-21 19:14:59.742529+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-infrastructure"], "entities": ["Grantor", "CrewAI", "LangGraph", "AutoGen", "Claude", "MCP", "Base"], "alternates": {"html": "https://wpnews.pro/news/give-your-ai-sub-agent-a-budget-not-your-keys", "markdown": "https://wpnews.pro/news/give-your-ai-sub-agent-a-budget-not-your-keys.md", "text": "https://wpnews.pro/news/give-your-ai-sub-agent-a-budget-not-your-keys.txt", "jsonld": "https://wpnews.pro/news/give-your-ai-sub-agent-a-budget-not-your-keys.jsonld"}}