Product / Agents· target design · sandbox
Agents can propose. Warrants decide.
A 53-tool MCP catalog, A2A handoffs, scoped WebMCP tools, and a CLI — all bounded by the same policy engine.
01 / SURFACES
Pick the protocol you already run.
Capability is defined once and exposed through adapters. A tool listing never implies a permission the caller lacks.
| Surface | Use | Status |
|---|---|---|
| MCP (streamable HTTP, stdio) | Agent tool calls with typed schemas | Target 2026-07-28 |
| A2A | Agent Card and task handoff | Target |
| WebMCP | Browser-local tools over authenticated actions | Optional |
| CLI | Operator and pipeline use | Specified |
| SDKs | Go, TypeScript, Python | Target |
02 / AUTHORITY
The boundary is server-side.
Tool annotations are hints. The server enforces scope, tenant, consent, and financial authority on every call.
An agent cannot approve its own warrant, escalate scope by switching transport, or turn a preview into an execution without a bound approval.
Credentials are scoped, expiring, revocable, and stored as verifiers. Revocation is immediate.
Agent desk
Operators see connected agents, granted scopes, recent calls, denied operations, and a one-click revoke. Every call returns a receipt.
Test it in the sandbox.
Every surface is exercised against fixtures before a production credential is involved.