Linchpin

Secure code execution

Run untrusted code from AI agents in isolated Docker containers with per-environment networking controls.

Multi-model agent workflows

Switch between cloud models (Claude, GPT, Gemini, Llama) and local models per agent without changing infrastructure.

Live UI streaming

Subscribe to session event logs over SSE for real-time monitoring or building live agent interfaces.

Credential management

Store and inject API keys or secrets securely into agent sessions without exposing plaintext data.

Tool integration

Plug in external tools via MCP servers or HTTP endpoints to extend agent capabilities.

Any model, one adapter

OpenRouter routes to ~200 cloud models (Claude, GPT, Gemini, Llama, DeepSeek, Mistral, Qwen), while Ollama runs any local model you've pulled. You can switch providers per agent.

Sandboxed sessions

Every session gets its own Docker container with Python, Node, git, and ripgrep preinstalled. Networking is per-environment—none for tight isolation, unrestricted for open egress.

Eight built-in tools

bash, read, write, edit, glob, grep, web_fetch, and web_search run inside the container, so the model can't escape.

MCP & HTTP tools

Plug in Model Context Protocol servers via stdio or point at any HTTP endpoint. The connector handles process lifecycle and credential injection.

Credential vaults

Fernet-encrypted credential store. Reference secrets by name from agent configs; they decrypt at session start and never hit disk in plaintext.

Event streaming

Append-only event log per session with cursor pagination. Subscribe over SSE—replays anything past your cursor, then streams live. Perfect for live UIs.