Palette
Mode
Or one accent
Surface
Saved in this browser. ⌘K has them too.
By what you are building
One-click SaaS
Open code, built and deployed in one click
/solutions/ai-agents
Your product publishes an interface — its MCP tools, discovered, each marked as a read, a write, a destructive or an outside call. People try them from the page, agents call them with grants tool by tool, and every call is written down before it runs.
/the-path
Six steps, from the tools your product offers to the agents that use them.
01
Deploy it as a container on your own server — from your code, an image or the Marketplace — health-checked and reversible.
Deployments02
Point a system at its MCP server — in the container, or at an address — or at its OpenAPI document. Its tools, instructions, resources and prompts are read at once.
Systems & MCP03
Every tool gets a class. Anything that does not declare itself read-only is a write; “reversible” is never guessed — you set it, and it survives the next reading.
Systems & MCP04
Call any tool from its page: a write is confirmed, a destructive one asks for its name. Every call is a ledger row with the arguments redacted — one history for people and agents.
Systems & MCP05
An agent built from files, granted tools one by one — never a wildcard for writes — that can never do what its owner cannot.
Agents06
Anything leaving your company is drafted and approved by a person unless your policy says otherwise; triggers wake agents on a schedule, a webhook or an event.
Agents/what-changes
Restarting a container and merging customer records are different risks, so they are different handles behind different permissions. An agent granted @crm-agent contacts.search can search contacts — and do nothing else, to nothing else.
@crm-api — the container: logs, restart, a shell.@crm-agent — the product: its tools, one grant each.A run is a trace: what woke the agent, what it read, each tool call with its decision and outcome, what waited for a person and what it cost. The calls land in the same ledger as everyone else’s.
/trust
Safety here is a set of mechanisms you can inspect, not a badge: what the platform will not do on its own, and what it writes down when it does.
Servers, networks, databases, buckets and secrets belong to one organization. Nothing is shared with anyone else.
A tool that changes data asks first; one that destroys it asks for its name typed back. Every call lands in a ledger.
Encrypted and versioned, handed to a container only at deploy time — over stdin, never in a command or a log line.
Every create shows the exact Docker commands it will run, with secrets by name, before anything is made.
The new container must pass its health check before the old one goes. If it fails, the old one is still serving.
Passkeys, two-factor, single sign-on with OIDC or SAML 2.0, verified email domains — and you can require them.
/start
Your systems and their ledger come first; agents call exactly those tools. Request early access to start.