# Mehen

> Access for agents. Use credentials without reading them.

Every page is also markdown: add `.md` to its address (the home page is `/index.md`), or send `Accept: text/markdown`.

## Start here

- [Mehen docs](https://docs.mehen.dev/index.md): What is Mehen, and how do I start?
- [Connect your agent](https://docs.mehen.dev/start.md): How do I get my agent connected, as a human?
- [Set up Mehen](https://docs.mehen.dev/setup.md): Agent, how do I connect this machine to a workspace?

## Concepts

- [The model in one page](https://docs.mehen.dev/concepts.md): What are the pieces, and how do they fit?
- [Workspaces and people](https://docs.mehen.dev/concepts/workspaces.md): What is a workspace, and who is in it?
- [Machines](https://docs.mehen.dev/concepts/machines.md): What is a machine, and what may it do?
- [Credentials](https://docs.mehen.dev/concepts/credentials.md): What is a credential, and where may it go?
- [Policy](https://docs.mehen.dev/concepts/policy.md): What decides whether a request goes through?
- [Intakes and connections](https://docs.mehen.dev/concepts/intakes-and-connections.md): How does a credential get into the vault?
- [Approvals](https://docs.mehen.dev/concepts/approvals.md): Who approves what, and how?
- [Needs you and asks](https://docs.mehen.dev/concepts/needs-you.md): What is an ask, and where does it show up?
- [Projects, environments and runs](https://docs.mehen.dev/concepts/projects.md): How do projects, environments, variables and mehen run work?
- [Audit, review and freeze](https://docs.mehen.dev/concepts/audit.md): What is recorded, and how do I stop things?

## Guides

- [Guides](https://docs.mehen.dev/guides.md): Which guide do I need?
- [Connect an agent to one workspace](https://docs.mehen.dev/guides/connect-one-workspace.md): How do I install or update mehen, enrol this machine and register the agents?
- [Several workspaces on one machine](https://docs.mehen.dev/guides/several-workspaces.md): How does one machine serve a personal and a work workspace?
- [A second identity on the same machine](https://docs.mehen.dev/guides/second-identity.md): When and how do I give an agent its own MEHEN_HOME?
- [Register mehen with each agent](https://docs.mehen.dev/guides/harnesses.md): How do I add the MCP server and the skill to Claude Code, Codex, Cursor, pi, Gemini CLI, OpenCode, VS Code, Claude Desktop or any MCP client?
- [Ask a human for a credential](https://docs.mehen.dev/guides/request-a-credential.md): How does an agent get a new key into the vault without seeing it?
- [Connect Gmail, GitHub or Microsoft](https://docs.mehen.dev/guides/oauth.md): How do OAuth connections work from the agent's side?
- [Find a credential and call an API](https://docs.mehen.dev/guides/call-an-api.md): How does an agent list, check and use a credential?
- [When a request needs approval](https://docs.mehen.dev/guides/approvals.md): What does an agent do with exit 3?
- [Project variables with mehen run](https://docs.mehen.dev/guides/projects.md): How do I give a coding project its variables without a .env?
- [A CI runner or a shared machine](https://docs.mehen.dev/guides/ci.md): How do I enrol a machine a team owns, and what can it reach?
- [A machine or a key is compromised](https://docs.mehen.dev/guides/incident.md): What do I do, in what order?

## Reference

- [Reference](https://docs.mehen.dev/reference.md): Where is each exact fact?
- [The mehen command line](https://docs.mehen.dev/reference/cli.md): What does each command do, and what are its flags, variables and exit codes?
- [MCP tools](https://docs.mehen.dev/reference/mcp.md): What are the vault_* tools and their inputs?
- [Errors and exit codes](https://docs.mehen.dev/reference/errors.md): What does each error mean, and what do I do?
- [Providers and templates](https://docs.mehen.dev/reference/providers.md): Which providers can an agent name, and what does each allow, hold and refuse?
- [The ask object](https://docs.mehen.dev/reference/ask.md): What is the shape a harness draws a card from?
- [mehen.toml](https://docs.mehen.dev/reference/mehen-toml.md): What goes in the project manifest?
- [HTTP surfaces](https://docs.mehen.dev/reference/http.md): What does a client see on the wire?

## Security

- [What Mehen protects, and what it does not](https://docs.mehen.dev/security.md): What is the promise, and where does it stop?
- [Threat model](https://docs.mehen.dev/security/threat-model.md): Who is the attacker, and what can they do?
- [Keys, proofs and signing](https://docs.mehen.dev/security/keys-and-signing.md): How do device keys, proofs, sealing, encryption, the audit hash, step-up and release signing work?
- [Reporting a vulnerability](https://docs.mehen.dev/security/disclosure.md): How do I report a security problem?

## Changelog

- [Changelog](https://docs.mehen.dev/changelog.md): What changed?

## For agents

- [Set up Mehen](https://docs.mehen.dev/setup.md): Agent, how do I connect this machine to a workspace?
- [The short guide](https://docs.mehen.dev/guide.md): What does mehen guide print?
- [The skill](https://docs.mehen.dev/skill.md): What do Claude and pi agents load?
- [Every page in one file](https://docs.mehen.dev/llms-full.txt): the markdown of every page above, in this order
- [The page index](https://docs.mehen.dev/index.json): every page with its question and headings, as JSON
- [Every error code](https://docs.mehen.dev/reference/errors.json): code, HTTP status, exit code, default next step, what it means and what to do, as JSON