Skip to content

Developers

Gasket is plain HTTP and JSON. No SDK to install, no framework to adopt. Or connect it as an MCP server and your AI client gets the tools directly.

lib/guarded.ts
// One function your tools call before anything consequential.
export async function guarded<T>(
  op: { service: string; operation: string; amount?: number; input?: object },
  run: () => Promise<T>,
) {
  const headers = {
    Authorization: `Bearer ${process.env.GASKET_API_KEY}`,
    "Content-Type": "application/json",
  };
  let a = await fetch("https://usegasket.xyz/api/v1/actions", {
    method: "POST",
    headers,
    body: JSON.stringify({ agent_id: process.env.GASKET_AGENT_ID, ...op }),
  }).then((r) => r.json());

  while (a.status === "pending_approval") {          // a person is deciding
    await new Promise((r) => setTimeout(r, 5000));
    a = await fetch(`https://usegasket.xyz/api/v1/actions/${a.id}`, { headers }).then((r) => r.json());
  }
  if (a.status !== "authorized") throw new Error(`Gasket: ${a.status}`);

  try {
    const out = await run();
    await fetch(`https://usegasket.xyz/api/v1/actions/${a.id}/result`, { method: "POST", headers, body: JSON.stringify({ status: "succeeded" }) });
    return out;
  } catch (e) {
    await fetch(`https://usegasket.xyz/api/v1/actions/${a.id}/result`, { method: "POST", headers, body: JSON.stringify({ status: "failed", error: String(e) }) });
    throw e;
  }
}

Use it as await guarded({ service: "stripe", operation: "refund.create", amount }, () => stripe.refunds.create(...)).

For AI clients

MCP server

Claude Code, Claude Desktop, Cursor and any MCP client get request_permission, check_action, report_result and list_agents.

claude mcp add --transport http gasket https://usegasket.xyz/api/v1/mcp
MCP setup →

In the dashboard

API Explorer

Send real requests as your workspace, see the decision, status code, latency and charge, then copy the same request as curl.

Open it with a free account →

Events

Webhooks

Get approval and action events pushed to your endpoint, signed with HMAC-SHA256 and retried with backoff, with every delivery listed.

Webhooks →

Official SDKs are planned. Until then every example on this site is plain fetch, requests or curl, and works as written.