Lanes Link — Access Profiles
lanes.sh- Category
- Developer Tools
- Rank
- No. 1451Tools index
Previous survey · No. 1398 ·
- Type
- TOOL
- Use case
- Security & Identity
- Interfaces
- MCP · CLI
- GitHub
- 35 stars
- Latest release
- v0.16.0
- Date
About
Access Profiles are Lanes Link's mechanism for scoping what an AI agent can reach: each profile defines which connected accounts (e.g. Gmail), which specific actions on them via glob-based allow/deny policies, which people may use it, and its own isolated memory, tasks, and skills. Grants can expire automatically, denials are logged, and a single MCP endpoint serves multiple named profiles so no default or credential is ever shared across boundaries like work and personal.
What it does
Lanes Link runs a single local server that every MCP-speaking assistant, such as Claude Code or Codex, talks to instead of wiring each one to your mail, calendar, issue tracker and so on. You sign in once per service, and the server holds those tokens itself. Each call an agent makes passes through a rule check before any service is touched, then gets written to a log. It also keeps plain Markdown notes, to-do items and personal procedures that any connected agent can read. You can run it on your own machine or deploy it to your own Google Cloud project for phone access.
Why it's ranked here
The permission model is real code, not a request that the model behave. Nothing is reachable until a rule grants it, a deny always beats an allow no matter which comes first in the file, and an unfinished approval mode fails closed by acting as a deny. The list of accounts an agent is shown is computed by the same check that blocks calls, so discovery cannot leak what invocation refuses. Pair that with Apache 2.0 licensing, a security policy that names its own limits, and a seven-day delay before new dependency versions can enter the lockfile, and this is a serious answer to agent access control.
What's good
Credentials are split by purpose. The tokens that let the server reach Google or Slack are never exposed to agents in any form, while your own passwords and API keys sit in a separate vault with a separate key and are released one item at a time. Each service integration only sees the secrets its own connection declares. The audit log has no update or delete operation at all, records refusals alongside successes, and stores argument names and types rather than values by default, so search queries stay out of the log. An optional compact mode swaps hundreds of tool descriptions for one search tool and one call tool.
Tradeoffs
The security policy is blunt about what it does not protect. Integration code is trusted and runs with no sandbox. Content coming back from your accounts is passed to the agent unscreened, so prompt injection in an email is your problem. Mail attachments can read any file the server's user can open. The project says most of its hundred-plus integrations are untested against a real account, and one banking integration can send irreversible payments. It needs Bun, runs only on macOS and Linux, requires a Lanes sign-in, and the managed hosted option is still a waitlist.
How to use it well
It fits someone running several AI assistants who wants one shared set of connections, notes and to-do items behind all of them, with hard rules on what each may do. Start with read-only grants, keep sending and payment actions denied, and use separate profiles for work and personal accounts. Run the server as an operating system user whose files you would be comfortable seeing attached to an email. Turn on the compact tool surface once you connect more than a handful of services. It does not screen untrusted content or isolate integration code, so pair it with care about which accounts you connect.
Technical notes+
src/policy/index.ts implements evaluation: capabilityMatches accepts exactly three pattern forms (*, provider.*, literal), evaluateDocument checks deny and approval_required before allow so rule order cannot change the outcome, isRuleActive honours an optional expiresAt, and evaluate applies an optional instance floor first so profile rules can only narrow. Rules are grouped per connection in a ProfilePolicy map, so an absent connection returns denied_default. allowedConnections reuses evaluate to build the connection enum shown to clients. src/dispatch/index.ts documents the fixed order policy, limits, provider, audit, with one audit event written from a finally block. src/audit/index.ts defines AuditSink with only append and close, redactAllValues as the default redaction, a redaction helper where withhold beats keep, and verify over hash chains with no range argument. src/secrets/index.ts separates system credentials from vault items on one AES-256-GCM document format with separate keys, and scopeSecrets gives providers an allowlist with no enumeration. src/cli/main.ts holds all control-plane commands; per ADR-007 there is no admin API reachable from MCP. package.json pins Bun 1.3.11 or newer and restricts os to darwin and linux. SECURITY.md lists the no-sandbox, unscreened content and unrestricted attachment path as documented properties.
Observed
- License
- Apache-2.0
- Language
- TypeScript, run on Bun
- Runtime requirement
- Bun 1.3.11 or newer
- Platform support
- macOS and Linux only
- Install surface
- Global npm package via Bun, ships a lanes CLI
- Interface
- MCP server over local HTTP
- Default permission
- Deny unless a rule grants access
- Integration isolation
- None, provider code is trusted
- Upstream content screening
- None, passed through by design
- Account sign-in
- Requires a Lanes sign-in
Read from README.md, package.json, LICENSE, SECURITY.md, docs/README.md, src/cli/main.ts, src/policy/index.ts, src/secrets/index.ts, src/audit/index.ts, src/server/mcp/index.ts, src/profile/index.ts, src/dispatch/index.ts.
What it can do
Create isolated Access Profiles scoping which accounts and actions an AI agent can use
Profile configuration → Access Profile
Connect accounts such as Gmail to an Access Profile
Account credentials → Connected account
Define glob-based allow/deny policies for actions on connected accounts
Glob patterns for actions → Access policy
Restrict which people may use a given Access Profile
List of members → Restricted access
Automatically expire access grants after a set time
Grant expiration setting → Expired grant
Log denied action attempts
Denied request → Denial log entry
Manage Access Profiles via the lanes CLI
CLI commands → Configured profile
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.