{"version":1,"generator":"agentbag-marketing","descriptor":"An operating system for agents","about":"https://agentbag.ai/status","statusMeanings":{"live":"Shipped and usable today.","beta":"Built and exercised, but gated, partially deployed, or deliberately not armed.","bench":"Not built as a first-class capability yet. We say so rather than implying otherwise."},"counts":{"live":7,"beta":3,"bench":1},"modules":[{"slug":"mail","name":"Mail","tagline":"Your agent has its own inbox, not a share of yours.","status":"live","caveat":"Inbound arrives by webhook from an email provider. We do not run our own MX or SMTP servers.","whatItDoes":"Every published agent gets a real, addressable mailbox. Inbound messages are classified, screened and quarantined before the agent ever sees them, contact details are vaulted and redacted by disclosure tier, and replies leave through an outbox that supports scheduled and cancellable sends. Threads link back to the work they belong to, so a message is never an orphan.","url":"https://agentbag.ai/bag/mail","proofPoints":[{"claim":"Screening happens before disclosure, not after","detail":"Inbound is classified and risk-scored on arrival; quarantined messages never enter the agent context, so a prompt-injection attempt in an email body has nothing to inject into."},{"claim":"Contacts are vaulted, and redaction is tiered","detail":"The agent sees a projection of a contact appropriate to the disclosure tier it has been granted, not the raw record."},{"claim":"Owners get a redacted digest, not a firehose","detail":"An opt-in forward digest summarises what the mailbox did, with the same redaction rules applied to the summary itself."},{"claim":"The outbox is reversible","detail":"Sends can be scheduled and cancelled before they leave, so \"the agent emailed a customer\" is a decision with a window, not an event."}],"related":["trustgraph","accesscontrol","events"]},{"slug":"package","name":"Package","tagline":"Export, share and install agents as portable archives.","status":"live","caveat":"Export, import, handoff links and showcase all work. There is no marketplace, no package versioning, and no signed packages.","whatItDoes":"An agent, its folder tree, config, knowledge and workflows are serialized into a single .agentpkg ZIP archive with a manifest, contributor list and provenance record. Installing one follows a three-step flow: Plan (inspect with zero writes), Review (verify a digest), Apply (write with a TOCTOU safety check). Three distribution modes ship: direct export to a file, private handoff links with an expiring share token, and a curated showcase gallery with verified proof-of-concept sample runs.","url":"https://agentbag.ai/bag/package","proofPoints":[{"claim":"Zero ID leakage across the package boundary","detail":"Internal UUIDs are re-minted with uuidv5 during serialization, so a package carries no account, tenant or folder identifiers from the source."},{"claim":"Three-step install with TOCTOU safety","detail":"Plan inspects with zero writes, Review verifies a digest, Apply checks the digest again before writing. A package that changed between review and apply is rejected."},{"claim":"Showcase carries verified sample runs","detail":"A workflow in the showcase gallery includes a redacted real run so someone can watch it work before installing it, and the verification is checked on display."}],"related":["events","mcp","docs"]},{"slug":"memory","name":"Memory","tagline":"Grounded retrieval over your own material, with receipts.","status":"beta","caveat":"This is retrieval, not persistent agent memory. Vector grounding is code-complete; the vector deployment is still pending.","whatItDoes":"Documents, transcripts and uploads are chunked, embedded and indexed, then retrieved by a hybrid of vector similarity, keyword match and graph centrality at answer time. Retrieved passages carry receipts, so an answer can point at the source that produced it, and access rules filter the corpus before retrieval rather than after.","url":"https://agentbag.ai/bag/memory","proofPoints":[{"claim":"Access filtering happens before retrieval","detail":"The corpus an agent can search is already narrowed by policy, so a permission mistake cannot surface as a leaked citation."},{"claim":"Hybrid scoring, not vector-only","detail":"Vector similarity is combined with keyword match and graph centrality, which is what keeps exact identifiers and rare terms findable."},{"claim":"Answers carry grounding receipts","detail":"The passage that produced a claim is attached to the claim, rather than reconstructed afterwards."}],"related":["docs","taxonomy","accesscontrol"]},{"slug":"calendar","name":"Calendar","tagline":"Scheduling by validated deep link: for now.","status":"bench","caveat":"There is no native calendar. The agent emits an allowlist-validated scheduling link; it does not hold events, check availability, or sync with Google or Outlook.","whatItDoes":"When a conversation reaches \"let us find a time\", the agent produces a scheduling call-to-action pointing at your existing booking tool, with the destination checked against an allowlist so it cannot be steered somewhere else. That is the whole of it today.","url":"https://agentbag.ai/bag/calendar","proofPoints":[{"claim":"The destination is allowlisted","detail":"The booking URL the agent emits is validated against a configured allowlist, so a conversation cannot talk the agent into linking somewhere arbitrary."},{"claim":"No availability, no event store, no sync","detail":"There is no calendar model behind this. If you need the agent to reason about free/busy time, it cannot do that today."}],"related":["mail","events"]},{"slug":"docs","name":"Docs","tagline":"A folder tree the agent reads, and a config file it obeys.","status":"live","caveat":"Extraction covers PDFs, spreadsheets and transcripts. Exotic binary formats are not parsed.","whatItDoes":"Documents live in a folder tree with real uploads: PDFs, CSVs and video transcripts are extracted, scrubbed of personal data and staged before they become part of what an agent can see. Each folder carries a plain-text config file whose settings cascade down the tree, so behaviour and grounding are defined next to the material they apply to rather than in a distant admin screen.","url":"https://agentbag.ai/bag/docs","proofPoints":[{"claim":"Config cascades down the folder tree","detail":"A setting on a parent folder applies to everything beneath it unless a child overrides it, the same model as directory-scoped config in a codebase."},{"claim":"Uploads are staged before they are live","detail":"Extracted content goes through a draft and test stage, so publishing new grounding material is a deliberate step rather than a side effect of a file drop."},{"claim":"Personal data is scrubbed on extraction","detail":"Extraction runs a sanitisation pass, so a CV dropped into a folder does not silently become retrievable in full."}],"related":["memory","accesscontrol","taxonomy"]},{"slug":"mcp","name":"MCP","tagline":"Both ends of the protocol: server and client.","status":"live","caveat":"Custom remote-MCP connectors authenticate with a static bearer token today. Full OAuth 2.1 for third-party MCP servers is planned, not shipped.","whatItDoes":"The platform is an MCP server: an OAuth 2.1 resource server with scope checks, an approval policy and a call ledger. This allows external clients to use your agents as tools. It is also an MCP client: any remote MCP server becomes a connector without per-provider code, guarded by a circuit breaker so a flaky third party cannot take a conversation down with it.","url":"https://agentbag.ai/bag/mcp","proofPoints":[{"claim":"Server side is a real OAuth 2.1 resource server","detail":"Scope checks and an approval policy gate tool calls, and calls are written to a session ledger rather than being fire-and-forget."},{"claim":"Client side is generic","detail":"Adding a remote MCP server is configuration. Only a couple of connectors have hand-written native adapters; the rest go through the generic path."},{"claim":"A failing tool server is contained","detail":"A circuit breaker trips on a misbehaving remote so its failures degrade one capability instead of the conversation."}],"related":["trustgraph","package","events"]},{"slug":"events","name":"Events","tagline":"A durable ledger of what agents did, and why.","status":"live","caveat":"The in-process event bus is a single-node emitter, not a distributed broker. The durable cross-agent record is a separate Postgres task ledger.","whatItDoes":"Agent-to-agent work is recorded as tasks, events, edges and artifacts in a Postgres ledger that survives restarts and can be replayed. A typed in-process bus carries roughly ninety kinds of domain event to subscribers within a node. Together they give you a timeline: what was asked, who it was delegated to, what came back, and where it stalled.","url":"https://agentbag.ai/bag/events","proofPoints":[{"claim":"The task ledger is durable and replayable","detail":"Tasks, events, delegation edges and artifacts are rows in Postgres, so a restart does not lose the trace and a stalled edge can be retried."},{"claim":"Cancel and retry are first-class","detail":"Actions against a running task are themselves recorded as events, so the intervention is part of the timeline."},{"claim":"The in-process bus is honest about its scope","detail":"It is a typed single-node emitter. We do not describe it as a distributed event backbone, because it is not one."}],"related":["trustgraph","package","mail"]},{"slug":"phone","name":"Phone","tagline":"Voice in and out, and SMS. Not phone calls.","status":"beta","caveat":"Speech-to-text and text-to-speech are live. SMS is built but flag-gated off and needs a carrier account. There is no inbound or outbound telephone calling.","whatItDoes":"Speech recognition and synthesis run self-hosted, routed per language across providers, with a turn-taking layer that handles interruption and sentence-level streaming so a spoken exchange does not feel like a walkie-talkie. A separate SMS path is implemented behind a feature flag for text messaging.","url":"https://agentbag.ai/bag/phone","proofPoints":[{"claim":"Speech runs self-hosted by default","detail":"Recognition and synthesis run as their own containers, with per-language provider routing for languages the local models handle poorly."},{"claim":"Turn-taking is explicit","detail":"A turn gate and sentence chunker manage interruption and streaming, rather than waiting for a full response before speaking."},{"claim":"Telephony is SMS-only and off by default","detail":"The SMS path is built but gated behind a flag and requires a carrier account. Voice calling was explicitly out of scope, and we have not built it."}],"related":["events","mail","taxonomy"]},{"slug":"trustgraph","name":"TrustGraph","tagline":"Which agent may talk to which, and what it may say.","status":"live","caveat":"Decisions and scoped tokens are enforced on the agent-to-agent paths. The explainability surface (\"why was this blocked\") is thinner than the enforcement.","whatItDoes":"Agent-to-agent requests are authorised before execution: the caller receives a scoped, one-time token, the request moves through an explicit state machine, and each edge between two agents carries a trust decision recorded for audit. Disclosure tiers govern not just whether an agent may answer but how much of the answer it may reveal.","url":"https://agentbag.ai/bag/trustgraph","proofPoints":[{"claim":"Authorisation happens before execution, not after","detail":"The agent-to-agent entry point resolves a trust decision first; an unauthorised call never reaches the model."},{"claim":"Caller tokens are scoped and single-use","detail":"A delegation carries a token minted for that hop, tracked in a ledger, rather than a reusable credential."},{"claim":"Disclosure is tiered, not binary","detail":"A decision can permit an answer at a reduced disclosure tier instead of choosing between full access and refusal."}],"related":["accesscontrol","events","mcp"]},{"slug":"accesscontrol","name":"AccessControl","tagline":"Per-document permissions that filter answers, not just pages.","status":"live","caveat":"Policy resolution is cached per session for speed; a permission change propagates on cache invalidation rather than instantly on every in-flight request.","whatItDoes":"Every folder and every leaf document carries an access policy: public, signed-in, or owner-approved. These policies resolve into a per-session envelope that filters what an agent can retrieve before it answers. A capability registry gates entire features per tenant, and the critical access checks fail closed.","url":"https://agentbag.ai/bag/accesscontrol","proofPoints":[{"claim":"The access envelope filters grounding, not just routes","detail":"Permissions narrow what the agent can retrieve, so a document you cannot open also cannot be paraphrased at you."},{"claim":"Critical checks fail closed","detail":"When policy cannot be resolved, the safe answer is refusal. The embed policy, for instance, falls back to \"frame nowhere\" rather than \"frame anywhere\"."},{"claim":"Capabilities are gated per tenant","detail":"A feature registry with presets and bundles decides what a workspace can even reach, independent of document permissions."}],"related":["trustgraph","memory","docs"]},{"slug":"taxonomy","name":"Taxonomy","tagline":"Knowing what a question is about before answering it.","status":"beta","caveat":"This is tagging plus a scope classifier. It is not an ontology: there is no hierarchical scheme you author and maintain.","whatItDoes":"Knowledge tags are derived from the material an agent is grounded in and from its connectors, and those tags are policy-aware: a tag can be visible while its underlying source is not. A tiered classifier decides whether an incoming question is inside the agent's scope, escalating from cheap pattern matching to embedding comparison only when it needs to.","url":"https://agentbag.ai/bag/taxonomy","proofPoints":[{"claim":"Tags respect access policy","detail":"A tag derived from restricted material does not leak the existence of that material to someone who cannot see it."},{"claim":"Classification is tiered for cost","detail":"Cheap pattern matching runs first; embedding comparison only runs when the cheap tier is not confident."},{"claim":"It is not an ontology, and we do not call it one","detail":"There is no authored hierarchy, no inheritance, no schema to maintain. If you need a formal taxonomy you manage yourself, this is not it yet."}],"related":["memory","docs","accesscontrol"]}]}