Agents with a leash, not a blank cheque.
An agent that can call your tools is an agent that can call your tools *as someone*. fastverk makes that someone you: identity is forwarded on every tool call, each plugin stays its own authorization boundary, and writes preview before they fire — they can't ask and act in the same turn.
"What can the agent do?" is the wrong question.
The right one is whose authority it is doing it with.
Most agent deployments provision a service account, grant it what the agent might need, and hope the prompt holds. That model fails in a specific and predictable way: the agent's reach is the union of what everyone might need, permanently, and the audit trail records a robot instead of a person.
Invert it. The agent carries your identity on every call, and each capability's owner — not the agent host — decides whether you may use it. Now the agent's reach is a reduction of yours, never an expansion, and the trail names a human.
An agent's reach is exactly yours.
Four properties that hold together — remove any one and the model collapses back to a service account.
Forward
The host forwards the signed-in user's identity on every tool call. There is no shared service account to over-scope, and the forge records a person rather than a bot.
Boundary
Each plugin's own MCP server is the authorization boundary. The host aggregates tools; it never decides what you may do. The owner of the capability does.
No static key
The model turn runs on Bedrock through the pod's IRSA role — there is no long-lived provider credential to leak, rotate, or find in a log.
Later turn
A write comes back flagged for confirmation as a preview. It only fires after you approve and the model re-calls it on a subsequent turn. It can't ask and act at once.
Preview first. Always.
Gating is by shape, not a hardcoded list — the owning plugin declares what mutates. Values illustrative.
| tool | kind | acting as | outcome |
|---|---|---|---|
| polyglot__search_code | read | you | returned 14 code units |
| tbzl__affected_targets | read | you | 312 targets · 9 repos |
| forge__open_pull_request | write | you | preview — awaiting approval |
| forge__merge | write | you | blocked — not approved |
The trail should name a person.
The alternative pools everyone's authority into one credential and then asks the logs to sort it out.
It's a faithful deputy: each plugin stays the authorization boundary, so an agent can only do what you could.
Backed by shipping plugins.
Each claim on this page is anchored to a plugin that provides it. The site build resolves these cross-references against the live feature catalog and fails if one of them doesn't exist — so this list can't quietly outlive what the platform ships.
Aggregates every plugin's tools into one turn and dispatches each call back through the owning plugin as you — a faithful deputy, with confirm-gated writes that preview before they act.
plugin detail →Thirteen agent-callable tools — seven read, six confirm-gated writes — acting as the signed-in user rather than a shared bot account, so the forge's own audit trail stays meaningful.
plugin detail →Agent work is a Kubernetes CR with a durable, resumable transcript and explicit lineage; escalate raises a HumanPrompt and blocks until a person answers.
plugin detail →A read-only BFF over the code index — agents ground in real code units before acting, and the indexer keeps ownership of the embeddings.
plugin detail →External facts come back as real, citable Wikidata entities from a read-only tool, cached by query hash — so a repeat is identical rather than freshly imagined.
plugin detail →Adjacent problems.
If the source is the asset, then every tool that touches it is a disclosure decision — including the ones you turned on to go faster.
Read more →An agent can open thirty pull requests an hour. The gate is what decides which of them are safe to merge.
Read more →Prove it's safe to merge.
Hosted, or launched into your own AWS account. Start free — no card required.