A data-sovereignty layer
for AI agents.

The gap

Agents need data access.
You need a policy, a signature, and a ledger.

There's no good way today to say "this agent may read my vault under Projects/BTO, but not Projects/MLC." No record of what it actually did. No way to revoke a single agent session without revoking the whole app it runs inside.

Token Holder sits between agents and the things they want to touch — API keys, vault files, usage data — and enforces three things: who is asking, are they allowed, and did it happen.

The three-level identity model

Consumer · Agent · Request.

Stripe's analog: merchant account, API key, signed HTTP request. Each layer verifiable and revocable independently.

Where we fit in the AI stack

Hardware all the way up to your files.
We're the pinch point just before your data.

Eight layers make modern AI work — physical silicon at the bottom, you at the top. Every layer below the dotted line is someone else's problem: NVIDIA, OpenAI, Anthropic, Meta, Claude Code, Cursor. The moment that stack reaches for your data, it talks to us.

The entire AI stack exists to help an agent do something useful. The minute that agent wants to touch your stuff, there's a narrow band where access has to be authorized, attributed, and recorded. That narrow band is everyone's blind spot — and it's the only layer we work on.

Hover any layer for detail.

How you plug in

Five minutes. One dependency.

The SDK is headless. Works in Node, Bun, Deno, edge runtimes, and browsers (with a provided token). Signs requests automatically when given an Ed25519 key or the TH_AGENT_PRIVATE_KEY env var.

import { createClient } from "@token-holder/client-sdk";

const th = createClient({
  consumerId: "my-app",
  agentId: crypto.randomUUID(),
  agentName: "research-bot-v1",
});

// every call gated, signed, audited, agent-attributed
const check = await th.checkGrant({
  dataType:   "obsidian_vault",
  permission: "read",
  path:       "Projects/BTO/readme.md",
});
if (check.allowed) {
  const file = await th.vault.read("Projects/BTO/readme.md");
}

// caller's OWN audit trail, no admin needed
const mine = await th.my.usage.summary();

Private alpha today — distribution via signed tarball. Reach out for access.

SOON A full docs site is in flight — MCP configs, CLI wrappers, framework integrations, compliance export formats. Alpha participants get direct access to the reference integrator (Clawnoly) while it's still private.

The verticals we're shipping

One protocol. Many surfaces.

Each piece is a separate package or product, but they all speak the same underlying Token Holder protocol. Pick the ones that match your integration — or run the whole stack and watch every agent on your machine at once.

The mascot

Why a Raven.

Ravens are pattern-watchers. They remember faces. They hold grudges against specific bad actors without painting the whole flock with one brush. That's exactly the job of the security layer — distinguish the agent that behaved from the one that didn't, keep receipts, and do it without getting in the way of the ones doing honest work.

The Raven is also the name of Token Holder's reference monitoring agent — an optional preset that watches the audit chain and flags anomalies. Mascot and implementation carry the same motif.