An agent is only as useful as what it can reach.
Capabilities are how a sandbox grows: GitHub, PostgreSQL, Sentry, Stripe, Discord, SSH, any MCP server. Each installs a real tool and keeps its credential in your sandbox — and one puts the agent on your own website.
- 25capabilities and connectors in the catalog today
- 0credentials the platform can read
- Any MCPserver or Claude Code plugin, by URL or git repo
Adding one tells you exactly what it will do
Before you paste a token, the card lists the effects: the skill the agent gains, the variable it lands in, the image fragment that installs the client.
The credential never leaves the sandbox
Secrets are written inside your sandbox and injected each turn. They are denylisted from the file relay, and the platform has no path to them at all.
Stays inside your sandbox
- Your code and repos
- Every credential and token
- The agent's transcripts
- The container and its image
All the platform holds
- Your identity (Google sign-in)
- The sandbox's name and URL
- Billing state
- Grants to invited teammates
What it stores is AES-256-GCM encrypted, with no decrypt path in the product.
The systems around one sandbox
A specialized agent is three or four capabilities from doing a real job: the repo, the database, the error tracker, the CI and deploys, the chat where its colleagues live.
Talk to it where your team already works
Connect Discord or Slack and the agent joins as a real participant. Assign work with an @mention; it plans, executes and reports back in the same thread.
Put it on your own website
One script tag drops a chat bubble on your site, answered by the same agent that has your repo, your docs and your tools. Every conversation opens on your fleet board for you to watch or take over.
- A read-only toolbox by default: it can read, search and fetch, nothing else.
- Each visitor thread runs in its own throwaway git worktree, behind a bot check.
