---
title: Introduction
description: AI-safe API access for agents — steeped in security
icon: BookOpen
---

# earl

`earl` is a security gate between AI agents and external APIs. Instead of giving agents broad network access and raw credentials, you define allowed API calls as HCL templates. Agents invoke those templates by name — nothing else.

```
┌─────────────┐      ┌──────────────┐      ┌─────────────────┐
│  AI Agent   │ ───▶ │     earl     │ ───▶ │  External API   │
│  (Request)  │      │ (Gate/Policy)│      │  (e.g. GitHub)  │
└─────────────┘      └──────────────┘      └─────────────────┘
       ▲                    │
       └──────── Result ────┘
```

## How It Works

1. **Define** — Write HCL templates describing API calls with typed parameters.
2. **Store** — Save secrets in the OS keychain via `earl secrets set`.
3. **Call** — Agents invoke `earl call 'provider.command(...)'` instead of raw HTTP.
4. **Enforce** — Earl resolves secrets at runtime, applies network rules, and blocks unsafe destinations.

<Callout type="warn">
  Restrict write access to `~/.config/earl/config.toml` and template files — the
  security model depends on it. See [Security](/docs/security).
</Callout>

## Documentation

<Cards>
  <Card title="Quick Start" href="/docs/quick-start" description="Your first constrained API call in minutes." />
  <Card title="Security Model" href="/docs/security" description="How earl protects secrets, enforces policies, and blocks attacks." />
  <Card title="AI Agent Integration" href="/docs/mcp" description="Expose templates as MCP tools for Claude and other agents." />
  <Card title="Configuration" href="/docs/configuration" description="Network policies, OAuth profiles, and search settings." />
  <Card title="Templates" href="/docs/templates" description="Author and manage HCL template files." />
  <Card title="CLI Reference" href="/docs/commands" description="Complete command reference." />
</Cards>
