Your source is the asset. Agents get answers, not a copy.
The risk in an agent isn't that it writes bad code — it's the reach it accumulates while writing good code. Here the reach is bounded by construction: read-only tools stay read-only, the index keeps the embeddings, writes preview before they fire, and every call carries your identity rather than a pooled one.
The risk isn't the code it writes.
It's the reach it accumulates while writing code that's perfectly fine.
Reviewing agent output is a solved-ish problem — that's what a merge gate is for. The harder exposure is quieter: a tool surface provisioned once, generously, because nobody wanted to be the reason the agent got stuck. Six months later it can read every repo, write to most of them, and does so under a credential that belongs to no one.
Bounding that is a design property, not a policy document. Read-only tools that have no write path can't be talked into one. An identity that is forwarded rather than pooled can't exceed its owner. A write that structurally requires a second turn can't be smuggled into the first.
Four boundaries that aren't policy.
Each one is a property of how the component is built, so it holds without anyone enforcing it.
Where the limits actually live
- The index keeps the embeddings. Code search is a read-only BFF: a caller gets code units and a deep-link to the exact lines, not the vector store and not a bulk export.
- The depot has no write path. It is a window on the content-addressed SCM substrate — four read-only tools, and every object named by its BLAKE3 hash so history can't be quietly rewritten.
- Authorization stays with the owner. Each plugin's own MCP server decides, so the agent host cannot grant reach the plugin wouldn't have given you directly.
- The proxy strips credentials. A workspace pod never receives the session that opened it, so compromising the pod doesn't yield the identity.
What can and cannot mutate.
Confirm-gating is by shape — the owning plugin declares what mutates, not a list maintained elsewhere. Values illustrative.
| surface | reads | writes | boundary |
|---|---|---|---|
| polyglot | code units + deep-links | none | read-only BFF |
| depot | repos, refs, trees, blobs | none | never a write path |
| mycelium | cited Wikidata entities | none | read-only, cached by hash |
| forge | 7 tools | 6, confirm-gated | acts as the signed-in user |
Least privilege, or a shared token.
The alternative provisions the union of what anyone might need and calls it enablement.
A read-only BFF — the indexer owns the embeddings. There is no tool that returns the corpus, because none was built.
Backed by shipping plugins.
Each claim on this page is anchored to a plugin that provides it. The site build resolves these cross-references against the live feature catalog and fails if one of them doesn't exist — so this list can't quietly outlive what the platform ships.
Dispatches every tool call back through the owning plugin as the signed-in user, so an agent's reach is a reduction of yours — and writes preview before they act rather than firing on call.
plugin detail →Acts as the signed-in user rather than a shared bot account, and six of its thirteen tools are confirm-gated writes — the other seven cannot mutate anything at all.
plugin detail →A read-only BFF over the code index: results are code units with a forge deep-link, and the indexer retains ownership of the embeddings rather than handing them to the caller.
plugin detail →Four read-only tools over the content-addressed SCM substrate — a window on history and trees, and never a write path.
plugin detail →Gates every request on session plus workspace ownership and strips your credentials before they reach the pod, so a workspace never holds the token that opened it.
plugin detail →Adjacent problems.
Turning agents on is a one-line change. Deciding what they may touch, whose authority they carry, and how you stop them is the actual project.
Read more →Some estates can't send their build plane to a vendor. The whole platform launches into your own AWS account instead.
Read more →Prove it's safe to merge.
Hosted, or launched into your own AWS account. Start free — no card required.