Universal AI agent platform
Connect an API, an MCP server or a database. AgentOS learns what it can do, turns it into an agent your team directs in plain language, and refuses to run anything it cannot independently verify.
execution trace
pausedNothing was deleted. The run is waiting for someone to approve delete_customer — with exactly these 32 records.
The difference
A chatbot
An AgentOS agent
Capabilities
An MCP server, a REST endpoint, an OpenAPI document and a SQL table all arrive as the same kind of thing: a described, schema-checked tool with a risk level attached.
Secrets are encrypted with a key separate from the application key and injected by the connector at call time — never a prompt, a response or a log.
Point AgentOS at a system and it proposes the tools, instructions and permissions. You review before anything is deployed.
A decision authorises one call with exactly the arguments a person reviewed — re-planning cannot reuse it.
Intent, tool choice, policy decision and result are kept per run, in a tamper-evident chain.
Web chat, Telegram, WhatsApp, Slack and email reach the same runtime under the same policy set. Configure the agent once.
How it works
Give AgentOS a URL and a credential. It never leaves the vault in readable form.
Endpoints, tables and schemas are inspected and normalised into tools.
You see the drafted agent — its tools, its limits, what needs approval — before deploying.
Ask in plain language. It works, reports back, and pauses when a human should decide.
Security model
An LLM can propose
delete_customer
with any arguments it likes. That is a request, not an instruction — and AgentOS
treats it as one.
Pricing
$0 /mo
Connect one system and see an AI employee work.
Start free$49 /mo
Put agents to work across a handful of systems.
Choose this plan$199 /mo
Multi-channel agents with human approval.
Choose this plan$799 /mo
Scale agents across the organisation.
Choose this planWhatever the system you connect exposes. AgentOS inspects an MCP server, REST API, OpenAPI document or database and turns its capabilities into tools an agent can call — reading records, creating them, running reports. It cannot do anything the connected credential is not permitted to do.
No. Credentials are encrypted with a key separate from the application key and are injected by the connector at call time. They are never placed in a prompt, a model response, a log line or a browser. The model only ever sees tool names and argument schemas.
The model is treated as an untrusted planner: it proposes a call, and the platform independently verifies that the tool exists, the agent may use it, your workspace owns the connection, the acting user holds the permission, and the arguments match the schema. Destructive operations pause for human approval, and an approval authorises exactly one call with exactly the arguments that were reviewed.
The runtime is provider-agnostic. Anthropic, OpenAI, Google and OpenAI-compatible endpoints are supported, and the provider is configuration rather than code — switching does not change how your agents behave.
No. You connect a system, AgentOS discovers what it can do, and you review the generated agent before deploying it. Editing instructions, enabling or disabling individual tools and deciding which ones need approval are all done in the interface.
There is a grace period before anything changes. After it, paid features are restricted but nothing is deleted — your connections, agents, execution history and audit trail are preserved, and paying restores access immediately.
Connect one system, review the agent it drafts, and see what it takes off your plate. Free plan, no card required.
We use cookies that are necessary to run the site. With your permission we would also use analytics cookies to understand which pages are useful. You can decline without losing any functionality — read the cookie policy.