Coral

Execution rails for agents.

Coral gives your agents execution rails for work with sensitive enterprise systems. It's self-hosted, open source, and you can use it with any agent and any system with an API.

Control each call, not just each tool. Most agent setups decide only which MCP tools an agent can see. That is all or nothing: if an agent can call update_record, it can update any record in any way the tool allows. Coral checks every call against your policy before it reaches the system. You allow it, block it, or require a person to approve that exact call and its arguments.

Less duplicated agent work. Agents start every task from scratch. They re-read tool schemas, retry failed calls, and spend tokens rewriting code for steps they got right yesterday. With Coral, agents save the code that worked as custom tools they call again in one step, and workspace owners can share them with the whole team.

Coral is used by thousands of developers at more than 450 companies for safer, more efficient agent work in customer support, SecOps, business intelligence, SRE, and more.

Quickstart · Download

In this example, an agent posts unreviewed PRs to Slack for the first time. The agent searches for the GitHub and Slack tools and writes code that calls them. It isn't allowed to post to Slack without approval, so the user approves the post. The agent then saves its code as a custom tool. The next day, the agent runs the same task by calling that custom tool.

Get started

1. Install Coral.

   • For yourself: download the desktop app for macOS, Linux, or Windows from the download page.
   • For your team: run a shared server with Docker Compose or Kubernetes.

2. Add a provider. A provider is one service your agents can use, such as GitHub or Linear. Pick one from the catalog, or bring your own OpenAPI document or MCP server. By default, tools that read data run right away and everything else needs your approval. See Add a provider.

3. Connect your agent. Copy your workspace's MCP URL from the Coral UI and add it to your MCP client:

   claude mcp add --scope user --transport http coral <your-mcp-url>   # Claude Code
   codex mcp add coral --url <your-mcp-url>                            # Codex
   

   For Cursor, VS Code, OpenCode, and other clients, see Connect an MCP client.

4. Ask a question. Ask your agent something that uses that provider, such as "What are my open pull requests?" Once a task works, your agent saves it as a custom tool it can call in one step next time.

Why Coral

MCP tool scopes are often broader than an agent use case requires, and agents waste time and tokens repeatedly figuring out how to do work that's been done before. Coral addresses both problems with custom tools. An agent saves code that worked as a private tool for itself. A workspace owner publishes the best ones as shared tools that everyone in the workspace can call.

• Precise control. Set Allow, Ask, or Block for each provider tool and each custom tool. An approval shows the exact call and its arguments, so Security approves one refund lookup, not the whole payments API.
• Cheaper models, same accuracy. With custom tools, a smaller model performs like a bigger one. For many tasks, this means Opus 5.5 accuracy at Haiku 5.5 cost.
• Faster, leaner agents. Across 34 benchmark tasks, custom tools cut tokens by 37%, cost by 31%, and time by 29%.
• Training data you own. Each run leaves a structured trace of the goal, the tools used, and the outcome that works well for post-training your own model.

From one developer's laptop to an enterprise cloud, Coral fits your stack:

• Runs on your infrastructure. Coral runs anywhere from a laptop to your own cloud, with zero data egress.
• Open source. Coral is licensed under the Apache License 2.0. Coral Enterprise adds organization-wide governance and support.
• Any agent, any system. It works with any AI app or agent that supports MCP. You can connect anything with an MCP server or OpenAPI document, including more than 5,000 databases and SaaS tools.

How Coral works

Agents write programs. To use tools, an agent writes a short TypeScript program. One program can call several tools, filter the results, and return only what the task needs. Less raw data passes through the model's context.

Coral runs them on rails. Each program runs in a sandbox, system credentials never appear in the agent's context or code, and every call is checked against your policy before it reaches the system behind it. Policies can also require a person to approve it.

This is the beginning of the README. Read the rest at the original. Read the full README ↗