PlexusThe capability gateway

Expose your own local tools — your notes, your calendar, your workspace — and let an AI agent call them through a default-deny, fully-audited boundary. Never by handing over a raw key.

Get running

Read the concepts

GitHub

The resource holds the boundary

Plexus represents the resource side. An agent that reaches the gateway still has zero authority — reaching it buys knowledge of what exists, never the right to call anything. Authority is something a human grants, scoped and revocable.

Self-describing, then compiled

A public floor advertises every exposed capability, its input shape, and how to use it — any agent can read it. For agents with a native idiom, Plexus compiles a per-agent plugin: a projection over that floor, so it feels native without ever replacing the source of truth.

Two credentials, never confused

You hold the connection-key — the admin credential. Each agent enrolls for its own durable, independently-revocable credential. An agent never sees the connection-key; a leaked agent credential is one agent's caps, not the keys to the house.

Sensitive actions can't be pre-approved

Read capabilities can stand for a while. Execute capabilities — running code — can never be standing: they are approved per use, every time. Not even the owner can waive that.

How an agent connects

Every step is code, not aspiration.

You connect an agent — name it, grant a starting capability set, mint a one-time enrollment code.
It runs one command — a per-agent plugin installs, redeems the code for its own durable credential, and deletes the code.
It calls capabilities — through its own launcher: list to discover what it can do right now, then the capability id to invoke. The command is its complete and only interface; it never hand-rolls HTTP or guesses at auth.