# Pigeon

> Delegated authority for AI agents.

- **Website:** https://github.com/pigeonlabsHQ/pigeon
- **Pricing:** unknown
- **Categories:** Developer Tools, AI Agents
- **Tags:** developer-tools, ai-agents, writing-content
- **Platforms:** CLI
- **Last verified:** 2026-09-10
- **Canonical page:** https://linkrena.com/tools/pigeon

## About

Your agent spawned a sub-agent and handed it the same API key. That sub-agent can now deploy to production, read the payments database, and merge to main.

Pigeon stops that. You hand the child a Pigeon Pass : a narrowed, signed credential for what it may do, not a copy of everything you can do.

There is no Pigeon server to connect to. You change two places you already have:

Spawn. Where you would have copied an API key into a sub-agent, call delegate(...) and give the child a Pass.

Tool. Where the side effect happens (deploy, query, MCP tool), call verify(...) and do not run the tool if it is denied.

Keep the real secret on the runner. The child carries the Pass.

A child cannot add capabilities, widen resources, raise a bound, or drop a parent constraint. If Pigeon cannot prove the child is narrower, it rejects.

This is an enforcement point, not part of the protocol. The client mints a narrower Pass per tool call. The server verifies it before the tool runs.

Identity tells you who the agent is. Authority tells you what it may do.

Pigeon is a small primitive. It is not a platform, a policy engine, an identity provider, or a key custodian. It does not stop prompt injection. It bounds blast radius along the dimensions you put on the Pass, and only those.

## Related tools

- [Ratify Agent Relay Harness](https://linkrena.com/tools/ratify-agent-relay-harness): Offline, one-command reproduction harness + adversarial annex for the Agent Relay x Ratify Phase 2 flagship.
- [Shelfprotocol](https://linkrena.com/tools/shelfprotocol): robots.txt for commerce — the open directory AI agents query before they buy - Signal-All/shelfprotocol
- [Experiential](https://linkrena.com/tools/experiential): An open source model gateway that provides one control plane across closed, open-source, local, and custom models.
- [Unitpost](https://linkrena.com/tools/unitpost): Email component library that works in Outlook, Gmail, and Apple Mail.
- [Markdown Gatekeeper](https://linkrena.com/tools/markdown-gatekeeper): Local-first authority layer for organizing Agent-facing Markdown - nanlogic/markdown-gatekeeper
- [TDQS](https://linkrena.com/tools/tdqs): An open framework for scoring how well an MCP tool definition communicates to an AI agent.