An agent is only as useful as what it can reach.
Capabilities are how a sandbox grows: GitHub, PostgreSQL, Sentry, Stripe, Discord, SSH, any MCP server. Each installs a real tool and keeps its credential in your sandbox.
- 25capabilities and connectors in the catalog today
- 0credentials the platform can read
- Any MCPserver or Claude Code plugin, by URL or git repo
Adding one tells you exactly what it will do
Before you paste a token, the card lists the effects: the skill the agent gains, the variable it lands in, the image fragment that installs the client.
The credential never leaves the sandbox
Secrets are written inside your sandbox and injected each turn. They are denylisted from the file relay, and the platform has no path to them at all.
Stays inside your sandbox
- Your code and repos
- Every credential and token
- The agent's transcripts
- The container and its image
All the platform holds
- Your identity (Google sign-in)
- The sandbox's name and URL
- Billing state
- Grants to invited teammates
What it stores is AES-256-GCM encrypted, with no decrypt path in the product.
The systems around one sandbox
A specialized agent is three or four capabilities from doing a real job: the repo, the database, the error tracker, the chat where its colleagues live.
Talk to it where your team already works
Connect Discord or Slack and the agent joins as a real participant. Assign work with an @mention; it plans, executes and reports back in the same thread.
Events that wake it
The same wiring makes agents event-driven. A push, an alert, a payment, an email or plain cron starts a fresh session, gated by a guard command you write.
Its own transcript, its own worktree, the same review before anything lands.