Executor is joining the YC S26 batch!

We’re building an open source MCP gateway to connect any agent to any service

Your team is constantly spinning up new agents, trying out new tools, wrangling multiple accounts. You need one place to configure everything once, and use them anywhere.

Executor gives you the ability to connect your agents to thousands of tools in a way that keeps you in control. Giving agents access to production services and data should be easy and predictable

Since launching the beta we’ve:

• Shipped a self-hostable Docker version
• Shipped a desktop app
• Shipped setup by chatting with your agent
• Shipped multi-account support
• Hit 2,000 GitHub stars
• Built a product loved by thousands of users

Truly appreciate all of the early support on it, has been incredible seeing all the ways people use it

There’s so much to build here. The past month has been laying the foundation. Now that that’s in place, next up is custom tools, generative UI, and workflows.

Setting it up is as easy as asking your agent “help use http://executor.sh”. Incredibly excited about what’s next, let me know all your feedback!

Executor — The gateway to connect your agent to everything

Source: https://executor.sh/ Executor is an MCP gateway. Anything that speaks MCP, like Claude Code, Cursor, or Codex, points at one endpoint and reaches every tool you connect.

SentryOpenAPI

GitHubGraphQL

LinearMCP

Wiring tools to agents is fiddly, per-client, and easy to get wrong. Executor makes every tool, from any protocol, look thesame: one name, one input schema, one output schema, so any agent can call any of them the same way.

Context efficiency

Thousands of tools, nobloat.

Connect everything you use and Executor still shows the model a single tool. It searches your catalog and loads a tool’s schema only when the code actually calls it, so the prompt never balloons.

Without Executor:1,640tools, about278,800tokens. With Executor: 1 tool, about1,044tokens.

Context window

Lower is better

Without Executor1,640tools · ~278,800tok

With Executor1 tool · ~1,044tok

Without Executor

1,640tools · ~278,800tok

"You are a helpful assistant.

Your tools are:

createIssue()
listPullRequests()
mergePullRequest()
createRelease()
addLabels()
createBranch()
getCommit()
// + 713 more GitHub tools
createCharge()
createCustomer()
createRefund()
listInvoices()
createSubscription()
capturePaymentIntent()
listPayouts()
// + 503 more Stripe tools
createIssue()
transitionIssue()
addComment()
assignIssue()
listSprints()
createProject()
searchIssues()
// + 233 more Jira tools
listIssues()
resolveIssue()
listEvents()
getProject()
muteIssue()
createRelease()
listAlerts()
// + 163 more Sentry tools
..."

With Executor

1 tool · ~1,044tok

// the only tool your client sees: "execute"

Execute TypeScript in a sandboxed runtime with access to
configured API tools.

## Workflow

1. const { items } = await tools.search({ query });
2. const path = items[0]?.path;
3. const details = await tools.describe.tool({ path });
4. const result = await tools[path](input);

## Available connection prefixes

- github.org.main: Production GitHub
- stripe.org.main: Live Stripe account
- jira.org.main: Team Jira
- sentry.org.main: Production Sentry

What you get

The model reasons. Executor handles therest.

One tool shape

MCP, OpenAPI, GraphQL, or a custom integration. Under the hood they all become a tool name, an input schema, and an output schema.

Call it any way

Today it is a code-mode MCP. It could just as well be the Executor CLI, a one-off script, a gen-UI dashboard, or a reusable workflow. Same tools, every surface.

Coming soon

Trace every call

One place to see every run and tool call. Audit any decision after the fact.

run_74211.42s

sentry.getIssue184ms

github.searchCode391ms

linear.createIssue612ms

Set up once, whole team has it

Per-user credentials and shared ones. No onboarding ritual, no toggling MCPs on and off mid-task.

Destructive actions pull you back in

Executor keeps the semantics it imported: GET vs DELETE for OpenAPI, destructiveHint for MCP, mutations for GraphQL. Agents auto-run the safe stuff and ask before the rest.

Sandboxed execution

Tool calls run in an isolated JavaScript sandbox. Secrets are injected host-side at call time and never enter the sandbox heap, so the agent and model never see a raw token.

Why we built it

Your agent should be able to reach your company’s resources in a way that isn’t scary. Most setups make you choose between locked down and useless, or wide open and risky.

Executor doesn’t care what you add. Once a tool is in that one shape, a name and two schemas, you can call it however you want and the same guardrails apply everywhere. That is the whole idea: make the safe path the easy path.

Get started

Pick yourpath.

Cloud

executor.sh/cloud

Hosted Executor. Auth, sync, policies, and your whole team online in five minutes. Free tier to start.

Try Cloud →

Desktop

Mac · Windows · Linux

A native app that runs entirely on your machine. Your integrations, credentials, and sessions never leave the device. MIT licensed.

CLI

npm i -g executor

Run Executor as a background service and drive it from your terminal. Best for headless and server environments. MIT licensed.

Read the docs →

View source →

FAQ

Where does my code run, and what touches my credentials?Tool calls run in an isolated JavaScript sandbox. Credentials are resolved host-side at call time and injected into the outbound request only. They never enter the sandbox heap, the code your agent wrote, the agent, or the model.

Can the agent or the model ever see a raw token?No. Secrets stay host-side by design. The sandbox calls a tool by name; Executor attaches the credential to the real request outside the sandbox, so a token is never present in anything the model can read.

What can call Executor?Any MCP client (Claude Code, Cursor, Codex, and others), the Executor CLI, or a native client you drop in. Because tools share one shape, the calling surface is interchangeable.

How does it know what is safe to auto-run?Executor preserves the semantics of whatever it imported: GET vs DELETE for OpenAPI, destructiveHint for MCP, and mutations for GraphQL. That tells the agent what it can run on its own and what should pull you back into the loop.

Is it open source? Can I self-host?Yes. Executor is MIT licensed and built on the SDK we publish to npm. Run the desktop app locally, self-host the server, or use the hosted cloud. Same code paths, different deployment.

Pricing

Start free, pay as yourun.

Get started

Free

For small teams getting started

$0/ month

Start free →

• Up to 3 members
• 10,000 included executions per month
• $0.20 per 1,000 additional executions
• Unlimited integrations

Recommended

Team

For growing organizations

$150/ org / month

Start Team →

• Unlimited members
• 250,000 included executions per month
• 5 minute execution timeout
• Join by team domain
• $0.20 per 1,000 additional executions

Custom needs

Enterprise

For orgs with custom needs

Custom

Contact us →

Everything in Team, plus

• Self-hosted or dedicated cloud deployment support
• SSO / SAML & SCIM provisioning
• Audit logs for every tool call
• Dedicated support & onboarding
• Security reviews, DPA & SOC 2 on request

Connect your agent toeverything.

ortry Executor Cloud →