Infrastructure
Tools are the security boundary, not a convenience layer
An agent is dangerous because it can act, not because it can reason badly. A model choosing the wrong tool is recoverable; a tool that lets it spend money without a ceiling is not. So the registry — not the prompt — is where capability is defined.
14-day evaluation · no card · start before you connect anything
How it works
- 1
Every capability is declared with a scope and a risk
A tool states what area it belongs to and how dangerous it is. The runtime offers an agent only the tools its scope and risk ceiling permit, so an agent is never even shown something it would be refused.
- 2
No tool takes a workspace
The workspace comes from the run’s context. If it were an argument, text an agent had read could point it at somebody else’s data — a prompt injection turning the model into a confused deputy.
- 3
Disabled means unavailable
A tool switched off in this workspace is not offered and cannot be called, rather than being offered and failing at the point of use.
- 4
Your own endpoints join the same registry
Where you register an endpoint of your own, an authorised action is carried out against it under the same checks as everything built in.
get_revenue_summary
Scope: analytics · Risk: readpropose_action
Scope: actions · Risk: low — and only the kinds this agent holdsYour own endpoint
Registered by you, checked like everything built in
No tool takes a workspace. It comes from the run’s context — if it were an argument, text an agent had read could point it at somebody else’s data.
What you can build with it
What an agent may reach is inspectable
The tools available to an agent are derived from its declared scopes, so reviewing its reach does not mean reading a prompt and hoping.
Personal details are masked before they leave
Prompts are masked by default at both the provider layer and the agent runtime. Sending something unmasked is an explicit declaration, and only one place in the product makes it.
Reserved names cannot be impersonated
A workspace cannot register a tool under a name that belongs to Xyranik’s own, so a tool cannot pretend to be one of ours.
Limits, and what is not served
Listed here rather than discovered against a rate limiter at three in the morning.
There is no third-party tool marketplace
You can register your own endpoint. There is no catalogue of community tools to install, and nothing is installed without somebody in your workspace doing it deliberately.
A tool is as reliable as the service behind it
Xyranik governs the call and records the outcome. It cannot make an unreliable endpoint reliable, and a failure there is reported rather than retried indefinitely.
Build an agent that can act without a blank cheque
Your agents ask the same gateway ours do, on a credential of their own, and are held to the same permissions, limits and record. The endpoint list is served by the API itself rather than written out here.