Let your agent drive.Keep the trunk locked.

Valet lets an AI agent run commands on your customer's machine: only what they approve, enforced on their machine, logged for both of you.

Get early accessHow it stays safe

Every session starts with a handover.

Every command asks first.

Your agent works inside the ticket the client handed over. Anything outside it waits for a yes on their machine, given with their own finger.

system_profiler SPDisplaysDataTypeMediumAllowed once by the clientChipset Model: Apple M2 Pro · Metal Support: Metal 3

Why your customers will say yes.

Valet hands them the stub of the ticket: the final say over their own machine, from the first permission to the last line of the log.

  • They pick what’s allowed. Start from nothing, everything or your list, and switch off anything they’d rather be asked about first.
  • They see the real command. Every prompt leads with the exact command, folder and program. Your agent’s reason comes second, marked as its own.
  • Their screen stays theirs. Valet runs commands, nothing else. No screen sharing, no mouse, no keyboard.
  • They can end it at any time. One click takes back every permission, stops everything the session started and seals the log.

Acme Inc.

Verified organisation

Find out why AcmeApp crashes when it opens.

60-minute session · you can end it at any time

NoneTemplateAll

Files

  • ~/Library/Logs/AcmeApp/**readLow
  • ~/Library/Application Support/AcmeApp/config.jsonreadLow

Programs

  • /usr/bin/logrunMedium
  • /usr/sbin/system_profilerrunMedium

Processes

  • All processeslistLow
Example session. Acme is a made-up vendor.

Your hardest tickets, without the screen-share call.

Crashes the report doesn’t explain. Installs that fail on one machine in fifty. Your agent looks on the customer’s computer itself, inside what they accepted, and every answer comes back as something it can act on.

  1. Connect your agent. Valet is an MCP server, so the agent you already run can use it as a set of tools.
  2. Send the customer a link. Start a session from your template. They review it and join from the Valet app.
  3. Get the signed log. When the session ends, you and your customer both receive the same sealed record of every step.

  1. create_sessiontemplate: "AcmeApp crash triage"

    The customer joined with 4 of 5 permissions

  2. run_commandsystem_profiler SPDisplaysDataType

    approvedAllowed once, with Touch ID

  3. read_file~/.ssh/id_ed25519

    deniedProtected location: SSH private key

  4. write_file~/Library/Application Support/AcmeApp/config.json

    timed_outNo answer within 60 seconds

end_session Log sealed · signature valid3f9a…c21e

Example session. Acme is a made-up vendor.

The sandbox enforces it. Not the agent.

Your agent asks; the customer’s machine decides. The rules are enforced where the commands run, not in the agent’s prompt.

  1. #114 permissions · protected places left out

    Session started from the template “AcmeApp crash triage”

    9c41…e07a

    Some places are never in a template. SSH keys, keychains, browser profiles and password managers can’t be granted ahead of time. Reaching one always takes its own high-risk approval.

  2. #12Running · inside the grants

    run_command /Applications/AcmeApp.app/Contents/MacOS/AcmeApp --diagnose

    9c41…e07a 51d2…a9f3

  3. #13Stopped by the sandbox · outside the grants

    AcmeApp opened ~/Documents/Taxes 2025.pdf

    51d2…a9f3 e8b0…14cd

    The operating system enforces it. The command only said --diagnose. The sandbox watched what the process actually did and stopped the read no grant covered. Valet never guesses from a command’s text.

  4. #14Every permission revoked · 1 process stopped

    Session ended by the customer

    e8b0…14cd 27fa…c630

  5. Same copy for Acme and the customer

    Log sealed · signature valid

    27fa…c630 3f9a…c21e

    One record, signed. Each entry carries the hash of the one before and is signed on the customer’s machine, so any edit shows.

Example session. Acme is a made-up vendor.

Not remote desktop. Not SSH.

Both were built for a person reaching a machine they look after. Valet is built for an outside agent working on someone else’s.

Remote desktopSSHValet
Who says yes to each action?Nobody, once the session startsNobody, once they’re logged inThe machine’s owner, for anything outside the grants
What can the other side reach?Whatever is on screen, with the mouse and keyboardEverything the account canOnly what the customer granted
Who enforces the limits?The person watching the screenThe account’s permissionsA sandbox on the customer’s machine
Is it built for an AI agent?It works through pixels: slow, costly, hard to checkA full shell, with nothing in betweenTools with plain answers: approved, denied, timed out
What’s left afterwards?A screen recording, if one was madeServer logs, if they were keptA signed log both sides hold

Every session ends with the stub.

When it’s over, the customer and your agent hold matching halves: the same signed record of every step.