Staging can't touch production. One switch stops both.

Every key belongs to one environment and can't reach another. Halt an environment and nothing more leaves it, approved calls included. Protect production, promote agent versions into it on purpose, and roll back with a pointer move.

Start buildingRead the docs

A few lines on your server, then connect a user.

  1. 1.SeparateA key is its environment: its actions, secrets, limits and records stay there.
  2. 2.ProtectMark production protected. Promoting into it needs an explicit yes.
  3. 3.HaltOne switch stops every call in the environment, with the reason recorded.

A staging agent that holds a production key is one bad deploy away from a production incident. With Anlyon the environment is bound to the key itself, so a staging key has nothing in production to reach.

Less risk

A runaway loop stops at one switch, and a halt can't silently lift, even after a cache flush.

Less cost

No second account, proxy or homemade flag to keep a test agent away from real customers.

Less effort

The same action names in every environment, each resolving its own secrets.

Where a call can go, and how to stop it. Isolation comes from the key, the stop before dispatch.

And changes to production are made on purpose.

A key is its environment

Every API key belongs to exactly one environment and resolves it when it signs in. Actions, secrets, invocations, approvals, limits and runs are scoped to it, and the same action name in staging and in production is two separate actions.

  • Each environment resolves its own secrets by name
  • Kinds: production, staging or development
  • A staging key can't read or halt production
Read about environments

One switch halts every call

Halt from the console, or call environment.halt({ reason }) from a runbook. Action calls are refused at dispatch, approved ones included, and a replay is refused too. Approvals can still be decided and reads still answer, so the team can clean up while nothing leaves. A member can halt; an admin resumes.

  • Needs environments:halt, a scope no key gets by default
  • If the halt state can't be read, the check reports halted
  • environment.halted and environment.resumed events
Read about the kill switch

Production changes on purpose

A new workspace's Production environment starts protected. Promoting a version into a protected environment needs an explicit confirmProtected acknowledgement, so nobody ships there by accident. Mark any environment protected, or remove it, in the console.

  • An environment you add is unprotected until you protect it
  • Protection and controlled promotion come with Pro and Team
  • Isolation and the halt switch are on every plan
Read about protection

Roll back with a pointer move

An agent's configuration ships as versions that never change. Promotion publishes a version into the target environment and copies no secret values, because each environment resolves its own. Rolling back moves the published pointer to an earlier version, which is still there.

  • An agent version can pin the exact action versions it shipped with
  • Every version in between stays, so you can move forward again
  • Manage agents and promotion in the console or the API
Read about promotion

A runaway loop? Stop everything in one call, with a reason.

Halting needs an operator key with environments:halt, not your agent's key. It halts the calling key's own environment, and the reason goes on the record.

Read about the kill switch
halt.ts
// An operator key holding environments:halt, not your agent's key.const operator = new Client({ apiKey: process.env.ANLYON_OPERATOR_KEY });await operator.environment.halt({ reason: "runaway refund loop" });// Every action call in this environment is now refused at dispatch,// including calls that were already approved.// When the incident is over:await operator.environment.resume();

Let your agent act for your users, safely.

A few lines of server code, then send a user a connect link. Nothing to host.

Start buildingRead the docs

$ claude mcp add --transport http anlyon https://api.anlyon.com/mcp