Developers

Embed secure handoff through both API and MCP.

Give AI agents controlled access to file and URL delivery while preserving purpose restrictions and audit logs. Sealith is designed around agent-era delivery paths from the start.

View Agent API View MCP See the demo OpenAPI JSON AI audit concept

Purpose-bound Agent Token

Constrain every token by purpose, allowed use, recipient type, recipient domain, scope, IP, expiry, and maximum file size. This is not a generic API key.

Both MCP and REST

Sealith is easy to connect from local-execution clients like Claude Code and Cursor. Remote-execution clients such as ChatGPT or Claude App depend more heavily on client-side file-transfer constraints.

AI actions stay in the audit log

Sealith records agent, purpose, allowedUse, recipientType, jobId, aiProvider, aiClient, tokenId, scope, and outcome so teams can see what was permitted before AI acted and what happened after.

Slack can be the next delivery path

On Business and above, connected Slack workspaces can receive Sealith share links in channels or DMs, while revoke, audit, and posting policy remain governed in Sealith.

Fastest integration path

Issue an Agent Token on Business or above.

Constrain scope and recipient domains for the intended use case.

Use either REST or MCP for create / receive. Short text files can complete in one call, while PDFs, images, and Office files use upload sessions or local helpers depending on the client runtime.

Optionally connect a Slack workspace and post Sealith links into channels or DMs from the web app.

Use list_handoffs to search deliveries and bulk_revoke to manage them in batches.

Append AI review notes with append_audit_context and verify evidence integrity when needed. purpose / jobId / aiProvider / aiClient are required.

Why Sealith

More than one-shot file delivery: Short text files can finish in a single request, while PDFs, images, and Office files rely on upload sessions or local helpers depending on the client runtime. Receive, revoke, logs, and audit context all stay on one governed base.
You can explain what AI did later: tokenId, jobId, purpose, aiProvider, aiClient, and result can be appended into the audit log, so LLM use ends as an accountable operating record rather than an opaque action.
Ship-ready assets are public: OpenAPI, the Postman Collection, and the MCP Quickstart are public, so teams can move from proof of concept to production along one path.
Beyond email-only B2B delivery: Current Slack integration can post Sealith share links into workspace channels or DMs. It operates as the next B2B delivery path beyond email, while workspace posting policy and revoke notices stay on the same control base.

Automation on the sending side

This is the main live use case today. Your own application or AI agent creates transfers and automates delivery to recipients.

Call create / finalize / revoke through API or MCP

If needed, let AI receive human-submitted materials through receive_handoff

Constrain purpose, allowed use, recipient type, scope, and recipient domains by token

Write jobId and tokenId into the audit log

Internal processing after receipt

If the receiving company also has a Sealith account, Business and above can route received documents into internal AI workflows. After receipt, that company acts as its own sender inside Sealith.

Route received contracts into a review AI

Route received invoices into an accounting AI

Keep a company-side record of who used which AI after receipt

How the Chrome extension fits in

The Chrome extension helps turn existing shared URLs into Sealith-governed URL shares. It is not an AI Agent Token path, but a workflow bridge for normal users inside the browser.

The Chrome extension does not use Agent Tokens. It creates governed URL shares through a normal user session.

It works with the current page URL, a clipboard URL, or a manually entered URL.

Gmail and Google Drive can show lightweight detection banners. Full Google Workspace admin controls remain a later phase.

Published assets

Sealith publishes both REST and MCP assets so teams can start with OpenAPI, Postman, or MCP quickstarts without building everything from scratch.

API guide MCP guide OpenAPI JSON Postman Collection Agent Token guide MCP Quickstart

Eligibility and constraints

Agent Token, Agent API, and MCP are available on Business and above.

Business is designed around 10 Agent Tokens, 1,000 AI handoffs per month, and 120 Agent API requests per minute.

Slack integration is also Business and above. Each connected workspace can enforce public/private/DM/Slack Connect and strict-mode posting policies.

A token raw secret is shown only once at issuance.

Agent Tokens are issued after TOTP confirmation and can be revoked from the issued-token list.

HTTP auth uses Authorization: Bearer sl_agent_....

Binary file completion still depends on whether the client runtime is local-execution based, like Claude Code or Cursor, or remote-execution based, like ChatGPT or Claude App.