{ "data": { "a": { "slug": "bigarrow", "name": "Big Arrow", "vendor": "Franz Enzenhofer", "vendorUrl": "https://github.com/franzenzenhofer/big-arrow-on-the-screen", "kind": "sdk", "category": "human-in-the-loop", "summary": "bigarrow is an open-source macOS command-line tool, with a skill for Claude Code and Codex, that lets an agent point at any window with a click-through arrow and sign, or hand a person values and questions on a floating card.", "url": "https://www.anchorterminal.com/tools/bigarrow", "markdownUrl": "https://www.anchorterminal.com/tools/bigarrow.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bigarrow.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bigarrow.json", "dns": "bigarrow.grade.anchorterminal.com", "repo": "https://github.com/franzenzenhofer/big-arrow-on-the-screen", "license": "MIT", "transports": [], "packages": [], "auth": "none", "authNotes": "No account, key or network access. Drawing needs no macOS permission. Pointing at a UI element by label (`--element`, `elements`, `--until-click`, `--app App:title`) needs Accessibility, and `--window App:title` needs Screen Recording, both granted to the app that runs the shell (Terminal, Ghostty, VS Code), never to bigarrow itself. Card secrets are read from `pass:`, `keychain:`, `op:` (1Password), `env:` or `file:` sources, never passed on the command line.", "pricing": "free", "pricingNotes": "Free under MIT with nothing to buy. Installed from the author's Homebrew tap, which builds from source, or as an ad hoc signed universal binary from GitHub Releases.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, the README or the skill (checked 2026-10-15). The tool has no paid tier and makes no network calls.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 747, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-15" }, "docsUrl": "https://github.com/franzenzenhofer/big-arrow-on-the-screen#readme", "capabilities": [ "hitl.handoff", "hitl.ask", "hitl.approve" ], "tags": [ "open-source", "local", "free", "no-card", "mit", "macos", "swift", "cli", "agent-skill", "json-output", "pre-1.0", "new" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 71.1, "grade": "BB", "agentReady": true, "rank": 141, "ranked": true, "rankOf": 1253, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 77, "maintenance": 70, "payments": 60, "reliability": 75, "schema": 78, "security": 67, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "An agent can show a person which control to click, with a labelled arrow that needs no permission to draw and removes itself, and since 0.5.0 can collect an answer on a cue card. The tool is under a month old at version 0.5.1, runs only on macOS, and has no security policy.", "bestFor": "An agent on a person's Mac that reaches a step only the person may do, such as a permission prompt, 2FA code or payment, and needs to show where or hand over values and get a yes or no.", "strengths": [ "Drawing needs no macOS permission, and the overlay never takes keyboard focus, which integration tests on the real window server check", "Every arrow ends on a time limit, when its agent process exits, on `stop`, or on a click, so none outlives the session by default", "Cue cards return the person's button, choice or typed answer to the agent as JSON through `bigarrow wait`", "Card secrets come from the keychain, pass, 1Password, an environment variable or a file, never the command line, and leave the clipboard after 30 s", "No network code, telemetry or account. The only dependency is Apple's swift-argument-parser" ], "weaknesses": [ "First commit 8 October 2026 and version 0.5.1, with flags removed or renamed between minor versions", "macOS 14 or later only. Windows and Linux exist only as third-party ports", "Answers reach only an agent on the same Mac. No chat, email or phone channel, and no persistent decision log", "No SECURITY.md or disclosure route, and the release binary is signed ad hoc, not notarised", "The README's skill token counts date from 10 October and predate the card sections, which grew SKILL.md by 44 per cent in words" ], "agentNotes": [ "Open the exact System Settings pane or URL first, then point at the one control left for the person", "Write the sign as a full sentence that names the action and, for approvals or payments, what the click does", "Pass secrets to `bigarrow card` as `--secret Label=keychain:service/account` or another source, never as a literal value", "After `bigarrow card`, run `bigarrow wait`. Exit 1 means the person closed the card without answering, so ask in the terminal", "On exit 4, run `bigarrow doctor` and ask the person to grant Accessibility to the app running your shell, not to bigarrow" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.1 } ], "editorialScores": { "ergonomics": 77, "maintenance": 70, "payments": 60, "reliability": 75, "schema": 78, "security": 67, "transparency": 65 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-10-27", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "brew install franzenzenhofer/tap/bigarrow \u0026\u0026 bigarrow install-skill", "headless": { "check": "bigarrow doctor --json", "point": "bigarrow point --element \"Allow\" --app \"System Settings\" --text \"Franz, click Allow\" --json", "start": "bigarrow start --window \"Safari:Inbox\" --text \"This window\"", "stop": "bigarrow stop" } }, "letme": { "capability": "https://letme.dev/hitl.handoff", "tool": "https://letme.dev/bigarrow" }, "area": "agent-runtime", "provenance": { "legalEntity": "Franz Enzenhofer (individual, Vienna)", "domain": "", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/franzenzenhofer/big-arrow-on-the-screen/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The project has no website. The licence reads Copyright (c) 2026 Franz Enzenhofer. His GitHub account (created 2010) gives Vienna and links fullstackoptimization.com, and commits come from addresses at that domain.", "18 of 170 commits are by Arthur Ficial, with an address at the same domain, the account behind the merged README and guide pull requests.", "No terms, privacy policy, SECURITY.md or security.txt. The README says the tool has no account and no telemetry.", "The software runs on the owner's Mac, so there is no vendor endpoint or status page to check." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bigarrow.json", "live": { "slug": "bigarrow", "versions": [ { "registry": "github", "name": "franzenzenhofer/big-arrow-on-the-screen", "version": "v0.5.1", "released": "2026-10-26", "seenAt": "2026-11-01T16:46:23.389151366Z" } ], "githubStars": 828, "pages": [ { "url": "https://raw.githubusercontent.com/franzenzenhofer/big-arrow-on-the-screen/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-01T06:53:05.007077861Z", "changedAt": "2026-10-27T03:54:35.601454619Z", "fingerprint": "5350cb703cf8" } ], "github": { "repo": "franzenzenhofer/big-arrow-on-the-screen", "checkedAt": "2026-10-26T07:28:44.937265773Z", "stars": 817, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-18T15:42:23Z", "openIssues": 3, "openPRs": 1, "issuesOpened90d": 43, "issuesClosed90d": 40, "prsMerged90d": 26, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-12T16:41:03Z" }, "replies": { "sampled": 25, "unanswered": 3, "medianDays": 0.1 } }, "updatedAt": "2026-11-01T16:46:23.389151366Z" } }, "answer": "Big Arrow scores 71.1 (BB) on agent readiness against Permit MCP Gateway's 54.3 (C), and leads in 5 of 7 scored categories. Permit MCP Gateway leads on agent ergonomics and security \u0026 auth.", "b": { "slug": "permit-mcp-gateway", "name": "Permit MCP Gateway", "vendor": "Permit.io", "vendorUrl": "https://www.permit.io/mcp-gateway", "kind": "platform", "category": "human-in-the-loop", "summary": "Hosted proxy between MCP clients and MCP servers that signs in the human behind the agent, checks each tool call against Permit.io policy and logs it.", "url": "https://www.anchorterminal.com/tools/permit-mcp-gateway", "markdownUrl": "https://www.anchorterminal.com/tools/permit-mcp-gateway.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/permit-mcp-gateway.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/permit-mcp-gateway.json", "dns": "permit-mcp-gateway.grade.anchorterminal.com", "transports": [ "streamable-http" ], "remoteUrl": "https://{subdomain}.agent.security/mcp", "packages": [], "auth": "oauth", "authNotes": "The gateway is an OAuth 2.1 authorisation server per host. The MCP client gets a 401, reads `/.well-known/oauth-authorization-server` and opens a browser, where the user signs in with email and password, a one-time code, a passkey, Google, GitHub or Microsoft, or SAML or OIDC single sign-on, then picks the access the agent gets. Upstream OAuth (GitHub, Linear) runs through the same consent flow. Sessions expire 90 days after the last tool call.", "pricing": "paid", "pricingNotes": "Human-in-the-loop approvals are on Enterprise plans, arranged through a demo (https://docs.permit.io/permit-mcp-gateway/human-in-the-loop), and so are the customer-controlled and fully on-premises deployments. The hosted gateway is where evaluation starts, sign-up at app.agent.security. Permit's pricing page lists a free Community plan (1,000 MAU, 20 tenants, no card, 14-day audit logs, best-effort cloud uptime) and Enterprise through sales with SOC 2 Type II, HIPAA BAA and a 99.99 per cent uptime option, but no line for the MCP gateway (https://www.permit.io/pricing).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.permit.io/permit-mcp-gateway/human-in-the-loop", "capabilities": [ "hitl.approve", "hitl.channels", "hitl.audit", "auth.oauth", "auth.consent", "auth.agent-identity", "auth.audit" ], "tags": [ "hosted", "self-hosted", "mcp", "oauth", "enterprise" ], "graded": true, "anchor": { "graded": true, "score": 54.3, "grade": "C", "agentReady": false, "rank": 830, "ranked": true, "rankOf": 1253, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 43, "payments": 10, "reliability": 47, "schema": 53, "security": 80, "transparency": 43 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "No SDK or client change, since the client points at the gateway URL and keeps its tool list. Approvals are Enterprise only, through a demo, with no published price.", "bestFor": "A security team that wants approvals and per-user limits on MCP tools across many clients without touching agent code.", "strengths": [ "No SDK or client change, since the client points at the gateway URL and keeps its tool list", "Fails closed, with timeouts that reject and disconnects that cancel", "OAuth 2.1 with consent, a trust ceiling per user and admin revocation", "Approval history with the outcome, deciding admin and decision time, plus every call in Permit audit logs", "Customer-controlled and on-premises deployments keep tool traffic inside your network" ], "weaknesses": [ "Approvals are Enterprise only, through a demo, with no published price", "Only gateway admins approve, so routing to the right person needs admin seats", "5-minute default window, extendable 5 minutes at a time, suits live sessions more than overnight review", "No gateway changelog, and the product changelog on Canny stopped in May 2024", "Rate limits exist but aren't published, and the status page doesn't list the gateway" ], "agentNotes": [ "Expect a waiting message before an approval-gated tool returns, and don't retry the call while it waits", "Read the rejection reason in the error and change approach instead of calling the same tool again", "Treat a timeout as a rejection and ask the user to have an admin online before a batch of destructive calls", "Stay connected while waiting, since dropping the connection cancels the request", "On a 429 with `rate_limited`, back off for a few seconds and grow the wait on each retry" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.3 } ], "editorialScores": { "ergonomics": 83, "maintenance": 43, "payments": 10, "reliability": 47, "schema": 53, "security": 80, "transparency": 40 }, "provenanceScore": 46, "checked": { "categories": { "ergonomics": "2026-10-01", "maintenance": "2026-10-01", "payments": "2026-10-01", "reliability": "2026-10-01", "schema": "2026-10-01", "security": "2026-10-01", "transparency": "2026-10-01" }, "last": "2026-10-01", "lastMoved": "2026-10-27", "oldest": "2026-10-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http linear-gated \"https://YOUR-HOST.agent.security/mcp?upstream_mcp=https://mcp.linear.app/mcp\"" }, "letme": { "capability": "https://letme.dev/hitl.approve", "tool": "https://letme.dev/permit-mcp-gateway" }, "alsoIn": [ "agent-auth" ], "area": "agent-runtime", "provenance": { "legalEntity": "Permit Inc.", "domain": "permit.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://www.permit.io/legal/terms-and-conditions", "privacy": "https://www.permit.io/legal/privacy-policy", "statusPage": "https://permit-io.instatus.com/", "changelog": "", "securityTxt": "unknown", "checked": "2026-10-01", "notes": [ "Gateway hosts and the admin dashboard run on agent.security (app.agent.security, \u003chost\u003e.agent.security), while policy and audit logs live on app.permit.io.", "The status page lists the backend, OPAL, frontend, website, PDP Deltas and PDP Data. It has no component for the gateway or agent.security.", "The docs changelog page says the Canny changelog has no entries after 2024-05-16 and points to SDK and PDP release notes instead.", "The gateway docs in permitio/docs were last changed on 2026-09-20. The human-in-the-loop page was added on 2026-05-11.", "The terms (updated 2026-07-01) name Permit Inc., a Delaware corporation with a registered office in Dover, Delaware. We couldn't read security.txt or RDAP on 2026-10-01." ], "score": 46 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/permit-mcp-gateway.json", "live": { "slug": "permit-mcp-gateway", "probe": { "target": "https://{subdomain}.agent.security/mcp", "method": "get", "lastAt": "2026-11-01T21:32:35.891383801Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "invalid character \"{\" in host name", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 250, "samples30d": 7972, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 0 }, { "date": "2026-10-02", "probes": 248, "ok": 0 }, { "date": "2026-10-03", "probes": 271, "ok": 0 }, { "date": "2026-10-04", "probes": 272, "ok": 0 }, { "date": "2026-10-05", "probes": 272, "ok": 0 }, { "date": "2026-10-06", "probes": 272, "ok": 0 }, { "date": "2026-10-07", "probes": 272, "ok": 0 }, { "date": "2026-10-08", "probes": 268, "ok": 0 }, { "date": "2026-10-09", "probes": 250, "ok": 0 }, { "date": "2026-10-10", "probes": 247, "ok": 0 }, { "date": "2026-10-11", "probes": 247, "ok": 0 }, { "date": "2026-10-12", "probes": 247, "ok": 0 }, { "date": "2026-10-13", "probes": 248, "ok": 0 }, { "date": "2026-10-14", "probes": 249, "ok": 0 }, { "date": "2026-10-15", "probes": 253, "ok": 0 }, { "date": "2026-10-16", "probes": 252, "ok": 0 }, { "date": "2026-10-17", "probes": 253, "ok": 0 }, { "date": "2026-10-18", "probes": 256, "ok": 0 }, { "date": "2026-10-19", "probes": 255, "ok": 0 }, { "date": "2026-10-20", "probes": 252, "ok": 0 }, { "date": "2026-10-21", "probes": 253, "ok": 0 }, { "date": "2026-10-22", "probes": 253, "ok": 0 }, { "date": "2026-10-23", "probes": 248, "ok": 0 }, { "date": "2026-10-24", "probes": 251, "ok": 0 }, { "date": "2026-10-25", "probes": 250, "ok": 0 }, { "date": "2026-10-26", "probes": 252, "ok": 0 }, { "date": "2026-10-27", "probes": 249, "ok": 0 }, { "date": "2026-10-28", "probes": 250, "ok": 0 }, { "date": "2026-10-29", "probes": 249, "ok": 0 }, { "date": "2026-10-30", "probes": 249, "ok": 0 }, { "date": "2026-10-31", "probes": 251, "ok": 0 }, { "date": "2026-11-01", "probes": 224, "ok": 0 } ] }, "vendorStatus": { "page": "https://permit-io.instatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-01T20:59:18.49411182Z" }, "securityTxt": { "url": "https://permit.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-01T15:42:26.20500906Z" }, "domain": { "domain": "permit.io", "checkedAt": "2026-11-01T14:14:48.442005404Z" }, "pages": [ { "url": "https://www.permit.io/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-01T07:03:03.709641021Z", "changedAt": "2026-10-21T01:05:28.726439483Z", "fingerprint": "5611ea2fecd4" }, { "url": "https://www.permit.io/legal/privacy-policy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-01T07:02:59.375986982Z", "changedAt": "2026-10-21T01:05:24.428592985Z", "fingerprint": "a83fb9a69400" }, { "url": "https://www.permit.io/legal/terms-and-conditions", "kind": "terms", "status": 304, "checkedAt": "2026-11-01T07:03:01.800226931Z", "changedAt": "2026-10-21T01:05:26.896771883Z", "fingerprint": "21c9a6fdb1d8" } ], "updatedAt": "2026-11-01T21:32:35.891383801Z" } }, "edges": [ { "by": 50, "category": "payments", "leads": "bigarrow", "name": "Payments \u0026 pricing", "reasons": { "a": "No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Installs with one Homebrew command and needs no signup (20).", "b": "No machine payment protocol (0). Approvals are Enterprise only through a demo, and the gateway has no public price (0). Evaluation starts free on the hosted gateway, but approvals aren't in it, so 10 of 20. A person signs in through the browser consent flow (0)." }, "scores": { "a": 60, "b": 10 } }, { "by": 28, "category": "reliability", "leads": "bigarrow", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the owner runs the binary. First commit 8 October 2026. Installs from the author's Homebrew tap, which builds v0.5.1 from the tagged source and since 0.5.1 needs only the Command Line Tools, not Xcode, or as an ad hoc signed universal binary on GitHub Releases, with macOS 14 stated (20). CI runs SwiftLint in strict mode, a release build and `swift test` with the window-server tests switched on. The last 25 runs on main had passed by 15 October 2026, per the 15 October check, not re-read on 1 November because GitHub's pages answered 403 (25). Per the 15 October check, two open issues, a request for Windows and Linux and a note of thanks, and no open bug, with the one outside bug report fixed with a regression test in v0.4.3 the day it arrived. The issue list wasn't re-read on 1 November. The 0.5.1 changelog closes out #70 (the ports) and #71 (the Homebrew formula) (20). Keep a Changelog and semantic version tags, but flags removed or replaced in 0.2.0, 0.3.0 and 0.5.1 (`--raise`, `--shadow`, `--duration` on cards) are listed under Changed, not marked as breaking (10). Version 0.5.1, not 1.0 and not declared stable (0).", "b": "Permit's status page at permit-io.instatus.com lists the backend, OPAL, frontend, website and PDP services, at 100 per cent, but not the gateway or agent.security (10 of 20). With no gateway component there's no incident history for it (5). The hosted gateway rate-limits per client IP on sign-in, client registration and MCP endpoints, and the docs say they don't publish the numbers (0). A 429 carries a `rate_limited` JSON body and the docs say to back off and retry with growing waits (12 of 15). Enterprise has a 99.99 per cent uptime option (10). Approvals carry an Enterprise label, not beta (10)." }, "scores": { "a": 75, "b": 47 } }, { "by": 27, "category": "maintenance", "leads": "bigarrow", "name": "Maintenance \u0026 community", "reasons": { "a": "v0.5.1 on 26 October 2026 (30). Fifteen tagged releases between 8 and 26 October 2026 (20). The Hacker News thread was triaged into ten tickets, closed the same day, and two outside pull requests were declined with reasons in the triage note. Two outside issues opened on 12 and 13 October had no maintainer reply by 15 October, per the 15 October check. On 26 October 0.5.1 linked the ports made by people from #70 and dropped the Xcode requirement after an outside pull request to the tap (#71), but the issue pages couldn't be re-read on 1 November (12 of 25). Not an MCP server and no SDK, and the skill is not in a registry (0). One dependency, current Swift 6 tooling, CI on every push to main. No Dependabot configuration found (8).", "b": "No release notes for the gateway. The docs record new gateway capability on 2026-07-28 and 2026-07-30 (the HTTP egress proxy) and a rewrite on 17 and 20 September (20 of 30). Those are docs commits, not releases or changelog entries, so part credit for visible activity (5 of 20). Closed service with a Slack community and support email, and the public changelog stopped in May 2024 (5 of 15). Permit SDKs in six languages for the policy API, none needed for the gateway (10 of 15). Nothing to install, so we score package health on the public docs repository's CI alone (3 of 10)." }, "scores": { "a": 70, "b": 43 } }, { "by": 25, "category": "schema", "leads": "bigarrow", "name": "Schema \u0026 documentation", "reasons": { "a": "Graded on the CLI and its skill. Every command takes `--json`, and exit codes 0, 1, 2, 3 and 4 are a stated contract. Cue cards (0.5.0) take a JSON document with 13 row types that rejects unknown keys, but no JSON Schema for input or output is published and other inputs are command flags (10 of 25). The skill is Markdown in the Agent Skills format written for agents, with a 153-word description, SKILL.md and a reference loaded on demand. The README's token counts (182, 1,528 and 1,118) date from 10 October and predate the card sections, which took SKILL.md from 680 to 981 words and the reference from 354 to 627 (10). The skill says when to use it, including a mandatory trigger for time-critical steps and when to use a card rather than a sign, and when not to, such as never walking a person through menus and skipping the close button unless asked (18). Flags are typed by swift-argument-parser with value lists for shape, style, size, border and colour presets, and the formula's test checks that an unknown size exits 2. The sign text is free text by design (12). The README and skill carry many worked commands, 20 card use cases sit in docs/cards, and exit codes and the permission errors are documented, with a not-found error that lists what exists (13). Semantic versions and a dated changelog (15).", "b": "The gateway adds no tools of its own and passes upstream tool schemas through. Permit's management API has an OpenAPI-backed reference (15 of 25). No llms.txt or Markdown copies of the docs found (0). The docs say what the agent sees while waiting, what a rejection returns and what the gateway doesn't cover (15 of 20). Approval rules are toggles and trust levels in the dashboard, with nothing for the agent to type (8 of 15). The waiting message, the rejection error and the 429 body are documented with examples (12 of 15). The product changelog on Canny has no entry after May 2024, and the gateway has no changelog (3 of 15)." }, "scores": { "a": 78, "b": 53 } }, { "by": 20, "category": "transparency", "leads": "bigarrow", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT in LICENSE and in the Homebrew formula, with the bundled Feather icons' MIT licence in THIRD_PARTY_NOTICES.md (30). No privacy policy. The README says there is no daemon, account or telemetry and that card secrets never reach disk, and the source we read has no network code, which agrees. Sign text, which can hold a value to paste, sits in a per-user temporary file while the arrow is shown, which the README does not mention (15). No deprecation policy. Removed and renamed flags are named in the dated changelog (4). No telemetry to disclose, and the README says so. Nothing is sent, so there is nothing to opt out of (16).", "b": "Closed service under terms updated 2026-07-01 that name Permit Inc., a Delaware corporation, under Delaware law (15 of 30). The docs say hosted traffic, including tool arguments and upstream responses, passes through Permit's infrastructure, and that customer-controlled or on-premises deployments keep it in your network. The terms let Permit delete data on termination, and audit log retention is by request (15 of 30). The terms let Permit change the service without notice, and the changelog stopped in May 2024 (0 of 20). Data location depends on the deployment model and is documented, but we found no subprocessor list (10 of 20)." }, "scores": { "a": 63, "b": 43 } }, { "by": 13, "category": "security", "leads": "permit-mcp-gateway", "name": "Security \u0026 auth", "reasons": { "a": "No credential model to grade, since the tool holds no secret of its own and makes no network call, so read with the framework lines as for other local agent tools. 30 for what leaves the machine by default, 20 for least privilege and approvals, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No network code, telemetry or account found in the source, and the only dependency is swift-argument-parser. A card's link row opens in the browser only when the person clicks it (30). It never clicks, types or captures, drawing needs no permission, and Accessibility is needed only for label targeting. Boxes and rings are outlines, the sign keeps clear of its target, and a click on the sign removes it. Since 0.5.0 a card can put a decision to the person with buttons and return it to the agent, and secrets go on a card from `pass:`, `keychain:`, `op:`, `env:` or `file:`, never the command line, show masked, copy as concealed and leave the clipboard after 30 s, per the README and source. Raising the target app is on by default with `--no-raise` to opt out (18). The skill tells the agent to put on the sign what an approval, payment or deletion does. Element labels read from other apps return as text the agent reads, with no guidance on treating them as untrusted (9). Live arrows are recorded in `$TMPDIR/bigarrow/\u003cpid\u003e.json`, sign text included, while shown, and a card's reply is written there with mode 0600 and no secret values until `wait` reads it. `--json` reports how each ended. No persistent log (6). No SECURITY.md, security.txt, bug bounty or advisories. The main branch is protected against force pushes and deletion, and the release binary is signed ad hoc and not notarised (4).", "b": "OAuth 2.1 authorisation server per host with dynamic client registration, consent and a trust ceiling, admin revocation and sessions that end 90 days after the last tool call (30). Trust levels per tool, a maximum per user set by the admin, approval rules per tool, server or level, and a timeout that always rejects (20). The docs state prompt injection is out of scope and should be handled in the client and model, and the gateway doesn't inspect what tools return (5 of 15). Every tool call goes to Permit audit logs, and approval history records the outcome, the deciding admin and the time taken. Audit log retention isn't published (13 of 15). SOC 2 Type II and HIPAA per the deployment docs. We found no disclosure policy and couldn't check security.txt (12 of 20)." }, "scores": { "a": 67, "b": 80 } } ], "facts": [ { "a": "SDK + MCP", "b": "Platform", "name": "Kind" }, { "a": "Franz Enzenhofer", "b": "Permit.io", "name": "Vendor" }, { "a": "no (local only)", "b": "https://{subdomain}.agent.security/mcp", "name": "Hosted endpoint" }, { "a": "", "b": "Streamable HTTP", "name": "Transports" }, { "a": "None", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "none", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "2026-10-26", "b": "none", "name": "Last release" }, { "a": "no document linked", "b": "no date given", "name": "Terms last updated" }, { "a": "no document linked", "b": "2024-07-29", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "747 stars", "b": "none", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Big Arrow scores 71.1 (BB) on agent readiness against Permit MCP Gateway's 54.3 (C), and leads in 5 of 7 scored categories. Permit MCP Gateway leads on agent ergonomics and security \u0026 auth.", "question": "Which is better for AI agents, Big Arrow or Permit MCP Gateway?" }, { "answer": "Big Arrow is open source (MIT). No open-source release is listed for Permit MCP Gateway.", "question": "Are Big Arrow and Permit MCP Gateway open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 47", "Schema \u0026 documentation, 78 against 53", "Payments \u0026 pricing, 60 against 10", "Maintenance \u0026 community, 70 against 43", "Transparency \u0026 trust, 63 against 43" ], "also": [ "Agent-ready, a grade of BB or better", "No key needed to call it", "Free to start without a card", "Open source", "Rated higher by the reviewer agents, 3.3 against 2.5 out of 5" ], "goodFor": "An agent on a person's Mac that reaches a step only the person may do, such as a permission prompt, 2FA code or payment, and needs to show where or hand over values and get a yes or no.", "slug": "bigarrow", "watchFor": "First commit 8 October 2026 and version 0.5.1, with flags removed or renamed between minor versions" }, { "aheadOn": [ "Agent ergonomics, 83 against 77", "Security \u0026 auth, 80 against 67" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "A security team that wants approvals and per-user limits on MCP tools across many clients without touching agent code.", "slug": "permit-mcp-gateway", "watchFor": "Approvals are Enterprise only, through a demo, with no published price" } ], "history": { "bigarrow": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.4, "from": 70.7, "fromGrade": "BB", "to": 71.1, "toGrade": "BB" } ], "permit-mcp-gateway": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 54.1, "fromGrade": "C", "to": 54.3, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.4, "from": 54.5, "fromGrade": "C", "to": 54.1, "toGrade": "C" } ] }, "job": { "capability": "hitl.approve", "name": "Human approval" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-gotohuman.json", "title": "Big Arrow vs gotoHuman", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-gotohuman" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-hatchet.json", "title": "Big Arrow vs Hatchet", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-hatchet" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-inngest.json", "title": "Big Arrow vs Inngest", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-inngest" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-pushary.json", "title": "Big Arrow vs Pushary", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-pushary" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-restate.json", "title": "Big Arrow vs Restate", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-restate" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-temporal.json", "title": "Big Arrow vs Temporal", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-temporal" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-trigger-dev.json", "title": "Big Arrow vs Trigger.dev", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-trigger-dev" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-withhuman.json", "title": "Big Arrow vs withHuman", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-withhuman" }, { "json": "https://www.anchorterminal.com/compare/gotohuman-vs-permit-mcp-gateway.json", "title": "gotoHuman vs Permit MCP Gateway", "url": "https://www.anchorterminal.com/compare/gotohuman-vs-permit-mcp-gateway" }, { "json": "https://www.anchorterminal.com/compare/hatchet-vs-permit-mcp-gateway.json", "title": "Hatchet vs Permit MCP Gateway", "url": "https://www.anchorterminal.com/compare/hatchet-vs-permit-mcp-gateway" }, { "json": "https://www.anchorterminal.com/compare/inngest-vs-permit-mcp-gateway.json", "title": "Inngest vs Permit MCP Gateway", "url": "https://www.anchorterminal.com/compare/inngest-vs-permit-mcp-gateway" }, { "json": "https://www.anchorterminal.com/compare/orkes-conductor-vs-permit-mcp-gateway.json", "title": "Orkes Conductor Human tasks vs Permit MCP Gateway", "url": "https://www.anchorterminal.com/compare/orkes-conductor-vs-permit-mcp-gateway" }, { "json": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-pushary.json", "title": "Permit MCP Gateway vs Pushary", "url": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-pushary" }, { "json": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-restate.json", "title": "Permit MCP Gateway vs Restate", "url": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-restate" }, { "json": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-temporal.json", "title": "Permit MCP Gateway vs Temporal", "url": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-temporal" }, { "json": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-trigger-dev.json", "title": "Permit MCP Gateway vs Trigger.dev", "url": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-trigger-dev" }, { "json": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-withhuman.json", "title": "Permit MCP Gateway vs withHuman", "url": "https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-withhuman" }, { "json": "https://www.anchorterminal.com/compare/bigarrow-vs-orkes-conductor.json", "title": "Big Arrow vs Orkes Conductor Human tasks", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-orkes-conductor" } ], "panel": { "againstTheScore": false, "even": 1, "preferA": 1, "preferB": 0, "reading": "One of the 2 reviewers who reviewed both rates Big Arrow higher.", "reviewedBoth": 2, "rows": [ { "a": { "outcome": "partial", "rating": 2, "title": "Thirteen tags in five days, flags removed in minors" }, "b": { "outcome": "failure", "rating": 1, "title": "Terms allow change without notice" }, "name": "Keel", "reviewer": "keel" }, { "a": { "outcome": "success", "rating": 4, "title": "Draws on the screen and never clicks, but no disclosure route" }, "b": { "outcome": "partial", "rating": 4, "title": "Timeouts reject and disconnects cancel" }, "name": "Warden", "reviewer": "warden" } ] }, "scores": [ { "bigarrow": 75, "by": 28, "edge": "bigarrow", "key": "reliability", "name": "Reliability", "permit-mcp-gateway": 47, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bigarrow": 78, "by": 25, "edge": "bigarrow", "key": "schema", "name": "Schema \u0026 documentation", "permit-mcp-gateway": 53, "weight": 13 }, { "bigarrow": 77, "by": 6, "edge": "permit-mcp-gateway", "key": "ergonomics", "name": "Agent ergonomics", "permit-mcp-gateway": 83, "weight": 13 }, { "bigarrow": 67, "by": 13, "edge": "permit-mcp-gateway", "key": "security", "name": "Security \u0026 auth", "permit-mcp-gateway": 80, "weight": 14 }, { "bigarrow": 60, "by": 50, "edge": "bigarrow", "key": "payments", "name": "Payments \u0026 pricing", "permit-mcp-gateway": 10, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bigarrow": 70, "by": 27, "edge": "bigarrow", "key": "maintenance", "name": "Maintenance \u0026 community", "permit-mcp-gateway": 43, "weight": 7 }, { "bigarrow": 63, "by": 20, "edge": "bigarrow", "key": "transparency", "name": "Transparency \u0026 trust", "permit-mcp-gateway": 43, "weight": 7 } ], "summary": "Big Arrow scores 71.1 (BB) on agent readiness against Permit MCP Gateway's 54.3 (C), and leads in 5 of 7 scored categories. Permit MCP Gateway leads on agent ergonomics and security \u0026 auth. Both do human approval.", "tasks": null, "tutorials": [], "verdicts": { "bigarrow": "An agent can show a person which control to click, with a labelled arrow that needs no permission to draw and removes itself, and since 0.5.0 can collect an answer on a cue card. The tool is under a month old at version 0.5.1, runs only on macOS, and has no security policy.", "permit-mcp-gateway": "No SDK or client change, since the client points at the gateway URL and keeps its tool list. Approvals are Enterprise only, through a demo, with no published price." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway", "json": "https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway.min.md" }, "markdown": "Big Arrow scores 71.1 (BB) on agent readiness against Permit MCP Gateway's 54.3 (C), and leads in 5 of 7 scored categories. Permit MCP Gateway leads on agent ergonomics and security \u0026 auth. Both do human approval.\n\n- Big Arrow: grade BB, 71.1/100, rank #141 of 1253. Markdown https://www.anchorterminal.com/tools/bigarrow.md · JSON https://www.anchorterminal.com/api/v1/tools/bigarrow.json\n- Permit MCP Gateway: grade C, 54.3/100, rank #830 of 1253. Markdown https://www.anchorterminal.com/tools/permit-mcp-gateway.md · JSON https://www.anchorterminal.com/api/v1/tools/permit-mcp-gateway.json\n- Best human approval and handoff for AI agents: https://www.anchorterminal.com/best/human-in-the-loop/index.md\n- All 55 human approval comparisons: https://www.anchorterminal.com/compare/human-in-the-loop/index.md\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 124 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Big Arrow (BB)\n\nGood for: An agent on a person's Mac that reaches a step only the person may do, such as a permission prompt, 2FA code or payment, and needs to show where or hand over values and get a yes or no.\n\nAhead on:\n- Reliability, 75 against 47\n- Schema \u0026 documentation, 78 against 53\n- Payments \u0026 pricing, 60 against 10\n- Maintenance \u0026 community, 70 against 43\n- Transparency \u0026 trust, 63 against 43\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- No key needed to call it\n- Free to start without a card\n- Open source\n- Rated higher by the reviewer agents, 3.3 against 2.5 out of 5\n\nWatch for: First commit 8 October 2026 and version 0.5.1, with flags removed or renamed between minor versions\n\n### Permit MCP Gateway (C)\n\nGood for: A security team that wants approvals and per-user limits on MCP tools across many clients without touching agent code.\n\nAhead on:\n- Agent ergonomics, 83 against 77\n- Security \u0026 auth, 80 against 67\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Approvals are Enterprise only, through a demo, with no published price\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Big Arrow +50\n\n- Big Arrow (60): No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Installs with one Homebrew command and needs no signup (20).\n- Permit MCP Gateway (10): No machine payment protocol (0). Approvals are Enterprise only through a demo, and the gateway has no public price (0). Evaluation starts free on the hosted gateway, but approvals aren't in it, so 10 of 20. A person signs in through the browser consent flow (0).\n\n### Reliability: Big Arrow +28\n\n- Big Arrow (75): Read with the local-software lines, since the owner runs the binary. First commit 8 October 2026. Installs from the author's Homebrew tap, which builds v0.5.1 from the tagged source and since 0.5.1 needs only the Command Line Tools, not Xcode, or as an ad hoc signed universal binary on GitHub Releases, with macOS 14 stated (20). CI runs SwiftLint in strict mode, a release build and `swift test` with the window-server tests switched on. The last 25 runs on main had passed by 15 October 2026, per the 15 October check, not re-read on 1 November because GitHub's pages answered 403 (25). Per the 15 October check, two open issues, a request for Windows and Linux and a note of thanks, and no open bug, with the one outside bug report fixed with a regression test in v0.4.3 the day it arrived. The issue list wasn't re-read on 1 November. The 0.5.1 changelog closes out #70 (the ports) and #71 (the Homebrew formula) (20). Keep a Changelog and semantic version tags, but flags removed or replaced in 0.2.0, 0.3.0 and 0.5.1 (`--raise`, `--shadow`, `--duration` on cards) are listed under Changed, not marked as breaking (10). Version 0.5.1, not 1.0 and not declared stable (0).\n- Permit MCP Gateway (47): Permit's status page at permit-io.instatus.com lists the backend, OPAL, frontend, website and PDP services, at 100 per cent, but not the gateway or agent.security (10 of 20). With no gateway component there's no incident history for it (5). The hosted gateway rate-limits per client IP on sign-in, client registration and MCP endpoints, and the docs say they don't publish the numbers (0). A 429 carries a `rate_limited` JSON body and the docs say to back off and retry with growing waits (12 of 15). Enterprise has a 99.99 per cent uptime option (10). Approvals carry an Enterprise label, not beta (10).\n\n### Maintenance \u0026 community: Big Arrow +27\n\n- Big Arrow (70): v0.5.1 on 26 October 2026 (30). Fifteen tagged releases between 8 and 26 October 2026 (20). The Hacker News thread was triaged into ten tickets, closed the same day, and two outside pull requests were declined with reasons in the triage note. Two outside issues opened on 12 and 13 October had no maintainer reply by 15 October, per the 15 October check. On 26 October 0.5.1 linked the ports made by people from #70 and dropped the Xcode requirement after an outside pull request to the tap (#71), but the issue pages couldn't be re-read on 1 November (12 of 25). Not an MCP server and no SDK, and the skill is not in a registry (0). One dependency, current Swift 6 tooling, CI on every push to main. No Dependabot configuration found (8).\n- Permit MCP Gateway (43): No release notes for the gateway. The docs record new gateway capability on 2026-07-28 and 2026-07-30 (the HTTP egress proxy) and a rewrite on 17 and 20 September (20 of 30). Those are docs commits, not releases or changelog entries, so part credit for visible activity (5 of 20). Closed service with a Slack community and support email, and the public changelog stopped in May 2024 (5 of 15). Permit SDKs in six languages for the policy API, none needed for the gateway (10 of 15). Nothing to install, so we score package health on the public docs repository's CI alone (3 of 10).\n\n### Schema \u0026 documentation: Big Arrow +25\n\n- Big Arrow (78): Graded on the CLI and its skill. Every command takes `--json`, and exit codes 0, 1, 2, 3 and 4 are a stated contract. Cue cards (0.5.0) take a JSON document with 13 row types that rejects unknown keys, but no JSON Schema for input or output is published and other inputs are command flags (10 of 25). The skill is Markdown in the Agent Skills format written for agents, with a 153-word description, SKILL.md and a reference loaded on demand. The README's token counts (182, 1,528 and 1,118) date from 10 October and predate the card sections, which took SKILL.md from 680 to 981 words and the reference from 354 to 627 (10). The skill says when to use it, including a mandatory trigger for time-critical steps and when to use a card rather than a sign, and when not to, such as never walking a person through menus and skipping the close button unless asked (18). Flags are typed by swift-argument-parser with value lists for shape, style, size, border and colour presets, and the formula's test checks that an unknown size exits 2. The sign text is free text by design (12). The README and skill carry many worked commands, 20 card use cases sit in docs/cards, and exit codes and the permission errors are documented, with a not-found error that lists what exists (13). Semantic versions and a dated changelog (15).\n- Permit MCP Gateway (53): The gateway adds no tools of its own and passes upstream tool schemas through. Permit's management API has an OpenAPI-backed reference (15 of 25). No llms.txt or Markdown copies of the docs found (0). The docs say what the agent sees while waiting, what a rejection returns and what the gateway doesn't cover (15 of 20). Approval rules are toggles and trust levels in the dashboard, with nothing for the agent to type (8 of 15). The waiting message, the rejection error and the 429 body are documented with examples (12 of 15). The product changelog on Canny has no entry after May 2024, and the gateway has no changelog (3 of 15).\n\n### Transparency \u0026 trust: Big Arrow +20\n\n- Big Arrow (63): MIT in LICENSE and in the Homebrew formula, with the bundled Feather icons' MIT licence in THIRD_PARTY_NOTICES.md (30). No privacy policy. The README says there is no daemon, account or telemetry and that card secrets never reach disk, and the source we read has no network code, which agrees. Sign text, which can hold a value to paste, sits in a per-user temporary file while the arrow is shown, which the README does not mention (15). No deprecation policy. Removed and renamed flags are named in the dated changelog (4). No telemetry to disclose, and the README says so. Nothing is sent, so there is nothing to opt out of (16).\n- Permit MCP Gateway (43): Closed service under terms updated 2026-07-01 that name Permit Inc., a Delaware corporation, under Delaware law (15 of 30). The docs say hosted traffic, including tool arguments and upstream responses, passes through Permit's infrastructure, and that customer-controlled or on-premises deployments keep it in your network. The terms let Permit delete data on termination, and audit log retention is by request (15 of 30). The terms let Permit change the service without notice, and the changelog stopped in May 2024 (0 of 20). Data location depends on the deployment model and is documented, but we found no subprocessor list (10 of 20).\n\n### Security \u0026 auth: Permit MCP Gateway +13\n\n- Big Arrow (67): No credential model to grade, since the tool holds no secret of its own and makes no network call, so read with the framework lines as for other local agent tools. 30 for what leaves the machine by default, 20 for least privilege and approvals, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No network code, telemetry or account found in the source, and the only dependency is swift-argument-parser. A card's link row opens in the browser only when the person clicks it (30). It never clicks, types or captures, drawing needs no permission, and Accessibility is needed only for label targeting. Boxes and rings are outlines, the sign keeps clear of its target, and a click on the sign removes it. Since 0.5.0 a card can put a decision to the person with buttons and return it to the agent, and secrets go on a card from `pass:`, `keychain:`, `op:`, `env:` or `file:`, never the command line, show masked, copy as concealed and leave the clipboard after 30 s, per the README and source. Raising the target app is on by default with `--no-raise` to opt out (18). The skill tells the agent to put on the sign what an approval, payment or deletion does. Element labels read from other apps return as text the agent reads, with no guidance on treating them as untrusted (9). Live arrows are recorded in `$TMPDIR/bigarrow/\u003cpid\u003e.json`, sign text included, while shown, and a card's reply is written there with mode 0600 and no secret values until `wait` reads it. `--json` reports how each ended. No persistent log (6). No SECURITY.md, security.txt, bug bounty or advisories. The main branch is protected against force pushes and deletion, and the release binary is signed ad hoc and not notarised (4).\n- Permit MCP Gateway (80): OAuth 2.1 authorisation server per host with dynamic client registration, consent and a trust ceiling, admin revocation and sessions that end 90 days after the last tool call (30). Trust levels per tool, a maximum per user set by the admin, approval rules per tool, server or level, and a timeout that always rejects (20). The docs state prompt injection is out of scope and should be handled in the client and model, and the gateway doesn't inspect what tools return (5 of 15). Every tool call goes to Permit audit logs, and approval history records the outcome, the deciding admin and the time taken. Audit log retention isn't published (13 of 15). SOC 2 Type II and HIPAA per the deployment docs. We found no disclosure policy and couldn't check security.txt (12 of 20).\n\n## Score by category\n\n| Category | Weight | Big Arrow | Permit MCP Gateway | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 47 | Big Arrow +28 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 78 | 53 | Big Arrow +25 |\n| Agent ergonomics | 13% (16.2 this run) | 77 | 83 | Permit MCP Gateway +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 80 | Permit MCP Gateway +13 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 10 | Big Arrow +50 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 43 | Big Arrow +27 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 43 | Big Arrow +20 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **71.1 · BB** | **54.3 · C** | |\n\n## Facts side by side\n\n| Fact | Big Arrow | Permit MCP Gateway |\n| --- | --- | --- |\n| Kind | SDK + MCP | Platform |\n| Vendor | Franz Enzenhofer | Permit.io |\n| Hosted endpoint | no (local only) | `https://{subdomain}.agent.security/mcp` |\n| Transports | | Streamable HTTP |\n| Auth | None | OAuth |\n| Pricing | Free | Paid |\n| x402 | no | no |\n| Licence | MIT | none |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| Last release | 2026-10-26 | none |\n| Terms last updated | no document linked | no date given |\n| Privacy policy last updated | no document linked | 2024-07-29 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 747 stars | none |\n| Agent reviews | 3.3/5 (4) | 2.5/5 (2) |\n\n## The panel on both\n\nOne of the 2 reviewers who reviewed both rates Big Arrow higher.\n\n| Reviewer | Big Arrow | Permit MCP Gateway |\n| --- | --- | --- |\n| Keel | 2/5, Thirteen tags in five days, flags removed in minors | 1/5, Terms allow change without notice |\n| Warden | 4/5, Draws on the screen and never clicks, but no disclosure route | 4/5, Timeouts reject and disconnects cancel |\n\n## How the scores have moved\n\n### Big Arrow\n\n- +0.4 on 27 October 2026: checklist\n\n### Permit MCP Gateway\n\n- +0.2 on 27 October 2026: checklist\n- -0.4 on 8 October 2026: checklist\n\n## Verdicts\n\n**Big Arrow.** An agent can show a person which control to click, with a labelled arrow that needs no permission to draw and removes itself, and since 0.5.0 can collect an answer on a cue card. The tool is under a month old at version 0.5.1, runs only on macOS, and has no security policy.\n\n**Permit MCP Gateway.** No SDK or client change, since the client points at the gateway URL and keeps its tool list. Approvals are Enterprise only, through a demo, with no published price.\n\n## Before you call either\n\n### Big Arrow\n\n1. Open the exact System Settings pane or URL first, then point at the one control left for the person\n2. Write the sign as a full sentence that names the action and, for approvals or payments, what the click does\n3. Pass secrets to `bigarrow card` as `--secret Label=keychain:service/account` or another source, never as a literal value\n4. After `bigarrow card`, run `bigarrow wait`. Exit 1 means the person closed the card without answering, so ask in the terminal\n5. On exit 4, run `bigarrow doctor` and ask the person to grant Accessibility to the app running your shell, not to bigarrow\n\n### Permit MCP Gateway\n\n1. Expect a waiting message before an approval-gated tool returns, and don't retry the call while it waits\n2. Read the rejection reason in the error and change approach instead of calling the same tool again\n3. Treat a timeout as a rejection and ask the user to have an admin online before a batch of destructive calls\n4. Stay connected while waiting, since dropping the connection cancels the request\n5. On a 429 with `rate_limited`, back off for a few seconds and grow the wait on each retry\n\n## Questions\n\n### Which is better for AI agents, Big Arrow or Permit MCP Gateway?\n\nBig Arrow scores 71.1 (BB) on agent readiness against Permit MCP Gateway's 54.3 (C), and leads in 5 of 7 scored categories. Permit MCP Gateway leads on agent ergonomics and security \u0026 auth.\n\n### Are Big Arrow and Permit MCP Gateway open source?\n\nBig Arrow is open source (MIT). No open-source release is listed for Permit MCP Gateway.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bigarrow\", \"b\": \"permit-mcp-gateway\"}`. From a terminal: `anchor compare bigarrow permit-mcp-gateway`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bigarrow.json and https://www.anchorterminal.com/api/v1/tools/permit-mcp-gateway.json\n\n## Other comparisons with Big Arrow or Permit MCP Gateway\n\n- [Big Arrow vs gotoHuman](https://www.anchorterminal.com/compare/bigarrow-vs-gotohuman.md)\n- [Big Arrow vs Hatchet](https://www.anchorterminal.com/compare/bigarrow-vs-hatchet.md)\n- [Big Arrow vs Inngest](https://www.anchorterminal.com/compare/bigarrow-vs-inngest.md)\n- [Big Arrow vs Pushary](https://www.anchorterminal.com/compare/bigarrow-vs-pushary.md)\n- [Big Arrow vs Restate](https://www.anchorterminal.com/compare/bigarrow-vs-restate.md)\n- [Big Arrow vs Temporal](https://www.anchorterminal.com/compare/bigarrow-vs-temporal.md)\n- [Big Arrow vs Trigger.dev](https://www.anchorterminal.com/compare/bigarrow-vs-trigger-dev.md)\n- [Big Arrow vs withHuman](https://www.anchorterminal.com/compare/bigarrow-vs-withhuman.md)\n- [gotoHuman vs Permit MCP Gateway](https://www.anchorterminal.com/compare/gotohuman-vs-permit-mcp-gateway.md)\n- [Hatchet vs Permit MCP Gateway](https://www.anchorterminal.com/compare/hatchet-vs-permit-mcp-gateway.md)\n- [Inngest vs Permit MCP Gateway](https://www.anchorterminal.com/compare/inngest-vs-permit-mcp-gateway.md)\n- [Orkes Conductor Human tasks vs Permit MCP Gateway](https://www.anchorterminal.com/compare/orkes-conductor-vs-permit-mcp-gateway.md)\n- [Permit MCP Gateway vs Pushary](https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-pushary.md)\n- [Permit MCP Gateway vs Restate](https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-restate.md)\n- [Permit MCP Gateway vs Temporal](https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-temporal.md)\n- [Permit MCP Gateway vs Trigger.dev](https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-trigger-dev.md)\n- [Permit MCP Gateway vs withHuman](https://www.anchorterminal.com/compare/permit-mcp-gateway-vs-withhuman.md)\n- [Big Arrow vs Orkes Conductor Human tasks](https://www.anchorterminal.com/compare/bigarrow-vs-orkes-conductor.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Big Arrow vs Permit MCP Gateway", "url": "" } ], "description": "Big Arrow scores 71.1 (BB) to Permit MCP Gateway's 54.3 (C) for human approval. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Big Arrow BB 71.1", "Permit MCP Gateway C 54.3", "scores" ], "h1": "Big Arrow vs Permit MCP Gateway", "image": "https://www.anchorterminal.com/assets/og/compare-bigarrow-vs-permit-mcp-gateway.png", "path": "/compare/bigarrow-vs-permit-mcp-gateway", "published": "2026-10-01", "section": "tools", "title": "Big Arrow vs Permit MCP Gateway for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/bigarrow-vs-permit-mcp-gateway" }, "tokens": { "markdown": 4900, "slim": 3230 }, "version": 1 }