DEV TOOLS Signal 476
UnYOLO: Agent credential broker and policy engine for your GitHub account
↗
Illustration only Photo by Matt Artz on Unsplash
UnYOLO is a credential broker and policy engine that sits between an AI agent and provider APIs like GitHub, so the agent never holds a real account token.
The project targets a specific failure mode of agentic workflows: an agent running with the same scope as a human can act outside the task you intended. Only one feed carried this, and the material is the project's own page, so the adoption picture outside Hacker News is unclear. For teams running agents against GitHub today, the interesting question is whether a policy file plus an approval inbox is a tighter control surface than scoped tokens plus audit logging.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The broker holds the provider credential and issues client-specific broker secrets, so a leaked agent token is bounded to the rules in the operator's policy file.
Policy is a single JSON file loaded at startup, with three effects (allow, request, deny), and a fixed decision order where deny wins over approved grants.
Approvals can be granted through a protected inbox listener or Telegram, are single-use or time-windowed, and may only narrow the grant's duration or use count once issued.
THE CLUSTER