For agents
CI your coding agent can read and cite.
OpenRunners exposes one operation registry through a REST API, a JSON-first CLI and a two-tool MCP server. Agents get the same run state people see, with scoped credentials and bounded output.
CLI
JSON by default.
The CLI stores credentials in the OS keychain and prints compact JSON. Add --output human for people. Errors carry stable codes and the API request ID.
printf '%s' "$OPENRUNNERS_TOKEN" | openrunners login --token-stdin
openrunners whoami
openrunners org use <organization-id>openrunners runs list --limit 20
openrunners runs get <run-id>
openrunners runs watch <run-id>
openrunners runs cancel <run-id>openrunners call runs.get \
--input '{"path":{"runId":"<run-id>"},"query":{},"body":{}}'MCP
Two tools. The whole registry.
Search returns compact contracts with valid call examples. Call invokes one exposed, stable operation. The server reads the same profile and keychain credential as the CLI.
openrunners mcp serve
# Tools exposed to the model
openrunners_search # find an operation contract
openrunners_call # invoke one stable operation IDcurl https://api.openrunners.dev/v1/admission \
-H "Authorization: Bearer $OPENRUNNERS_TOKEN" \
-H "OpenRunners-Organization-Id: <organization-id>"Safety contract
Built for callers you do not fully trust.
One registry
Every public operation has one stable ID, path, risk level and scope set. The API, CLI, MCP server and dashboard cannot invent an operation outside it.
Credentials stay out of prompts
Tokens live in the operating-system keychain. Organization selection comes from the profile, never from model-visible arguments.
Untrusted data is labeled
Repository names, logs, workflow output and diagnostics keep their provenance and are marked untrusted.
Bounded and idempotent
Messages and responses are size-capped. Every mutation takes an idempotency key, so a retry cannot run twice.
Dangerous calls stay closed
Destructive operations are never exposed to MCP. Dangerous ones need a short-lived human authorization grant.
Same limits everywhere
Admission state, SKU limits and the billing-disabled status read the same through every surface.
FAQ
Agent questions.
Any MCP client that supports the stdio transport, including Claude Code and Codex. Start it with openrunners mcp serve.
No. Repository selection needs the explicit --approve flag in the CLI or a human in the dashboard. It is not exposed through MCP.
Not during the alpha. Customer admission is closed, and admission requests return execution_admission_closed.
Give your agents a runner with a record.
Admission is manual for trusted GitHub repositories while the release gates close. Sign in with GitHub to request access and we will review your organization when a slot opens.