The same workspace your team writes to is exposed as an MCP server. Claude Desktop, Cursor, Lindy, Codex — anything that speaks MCP — reads and proposes writes through one addressable surface.
Read tools never mutate. Write tools never apply — they propose. Apply tools require reviewer scope. The shape of the surface is the safety model.
Every write carries an Idempotency-Key. The second call returns the first response from a 200-key LRU with a 10-minute TTL. Try it →
Search, fetch, list, walk. Cannot create, update, delete, or apply anything. Safe to hand to any tool that just needs to know things.
Can read everything and stage batched proposals. Proposals land in a review queue; nothing is applied without a human (or an apply-scoped token) signing off.
Reserved for trusted agents and human reviewers. Applies queued proposals after the review surface signs off. Pair with a separate identity than your everyday agent.
Proposals look like diffs. Each op has an apply/reject toggle. You can accept partial — apply two of three ops, send the third back. The agent that proposed gets a structured response on the next read.
Skills are versioned, named, scoped agents. Push one with skills/push, call it from chat or MCP. The workspace ships with a useful default set.
We don't ship a custom protocol. If your client speaks the Model Context Protocol, point it at your workspace's MCP URL and the tools show up.
Every API call emits a single line of JSON to stdout, Vercel Log Drain compatible. Request id, correlation id, workspace, actor (human or agent), tool, latency. No bodies, no bearers, no surprises.
Beta tokens come with a generous quota and the MCP catalog enabled by default. No client lock-in: same surface across MCP, REST, and the JS SDK.