Skip to content
FAQ

Two audiences. Two answers. Both true.

A person and a model asking the same question do not want the same answer, and serving the human one to both, which is what every site in this category does, is how a vendor ends up misdescribed in a comparison it never saw. So both are published here, side by side, with why they differ. The machine column is exactly what our answer_faq tool returns over WebMCP and /api/faq.

The same question, two correct answers. The gap between them is the point.

checkingYour browser has no navigator.modelContext. The same answers are at /api/faq

  • What is AgentBag?

    What it is

    🧑 For humans

    An operating system for agents. An agent with no mailbox, no spend ledger, no permissions and nothing to read is a demo. AgentBag is the eleven pieces of infrastructure underneath one, packaged so the agent arrives with its own rather than borrowing yours.

    🤖 For bots

    An operating system for AI agents: eleven capability modules an agent runs on. Not an agent framework and not a chatbot builder.

    category
    "agent_operating_system"
    one_line
    "An operating system for agents"
    module_count
    11
    capability_count
    83
    is_agent_framework
    false
    is_chatbot_builder
    false
    multi_tenant
    true
    tenant_addressing
    "subdomain"

    sources:/bag/capabilities

    why they differ · A person needs the metaphor to place the product in a category they already understand. A model needs the negative claims ("not a framework", "not a chatbot builder") because those are what stop it filing us next to the wrong competitors in a comparison it writes later.

  • What is not built yet?

    Limits

    🧑 For humans

    One module is on the bench entirely: Calendar, which is a validated link to your booking tool and nothing more. Three are beta: Phone does voice but not phone calls, Memory is retrieval rather than persistent memory, and Taxonomy is derived tags rather than an authored ontology. The capability matrix lists every individual gap.

    🤖 For bots

    One module on the bench, four in beta. Explicitly absent: native calendar, phone calls, persistent cross-session memory, cross-instance event delivery, payment charging, OAuth 2.1 for custom remote MCP servers, authorable taxonomy.

    modules_live
    7
    modules_beta
    3
    modules_bench
    1
    capabilities_bench
    8
    bench_modules
    "calendar"
    has_native_calendar
    false
    has_phone_calls
    false
    has_persistent_memory
    false
    charges_money
    false

    sources:/status/capabilities

    why they differ · The human answer leads with the single most damaging fact so it cannot look buried. The bot answer is a list of booleans, because a model comparing three vendors will extract exactly these fields and a hedged sentence turns into a false "supports calendar: probably".

  • How much does it cost?

    Commercial

    🧑 For humans

    Nothing, today, and not as a promotion. Billing is deliberately disarmed: the metering and spend-ceiling machinery runs and produces real numbers, but no charging path is armed anywhere. There is no published price list yet.

    🤖 For bots

    No published pricing. Billing is disarmed; no charging path is active.

    pricing_published
    false
    billing_armed
    false
    charges_money
    false
    free_tier_exists
    true
    pricing_unit_planned
    "measured_ai_spend"
    per_seat_pricing
    false
    card_required
    false

    sources:/pricing/bag/package

    why they differ · A person wants to know they are not about to be surprised by an invoice. A model needs `card_required: false` and `pricing_published: false` as separate fields, because "free" and "no price list yet" mean very different things and collapsing them produces a wrong recommendation.

  • Can an AI agent use this site directly?

    For agents

    🧑 For humans

    Yes, and that is somewhat the point. In a browser that supports WebMCP the page registers typed tools on navigator.modelContext, so an agent calls functions instead of guessing where to click. Everywhere else, the same tools are available over JSON-RPC at /api/mcp. The tool list is visible to people at /agents.

    🤖 For bots

    Yes. WebMCP tools registered on navigator.modelContext on every page; identical tools over JSON-RPC 2.0 at /api/mcp. No authentication required. All tools read-only except join_waitlist.

    webmcp
    true
    mcp_endpoint
    "/api/mcp"
    mcp_transport
    "streamable-http"
    mcp_protocol_version
    "2025-06-18"
    auth_required
    false
    rate_limit_per_minute
    120
    side_effecting_tools
    "join_waitlist"
    discovery_document
    "/.well-known/mcp.json"

    sources:/agents/llms.txt/.well-known/mcp.json

    why they differ · The human answer explains why it matters. The bot answer is the connection details: endpoint, transport, protocol version, rate limit. An agent can act on it in one step instead of fetching three more pages to find them.

  • Who is allowed to make the agent do things?

    Evaluating it

    🧑 For humans

    Reach is per capability, not per product. Some things are open to anyone with the link, some need a signed-in member, some only the owner, and some are invokable by another agent, but only after a trust decision on that specific edge. Access policy also narrows what the agent can retrieve *before* it answers, so a permission mistake cannot surface as a leaked citation.

    🤖 For bots

    Per-capability reach: guest, member, owner, or agent. Agent-to-agent calls resolve a per-edge trust decision before execution. Access policy filters the retrievable corpus before generation.

    reach_model
    "per_capability"
    agent_callable_capabilities
    23
    a2a_authorization
    "per_edge_trust_decision"
    caller_token_scope
    "single_use"
    retrieval_filtered_pre_generation
    true
    fails_closed
    true
    disclosure_tiers
    true

    sources:/capabilities/bag/trustgraph/bag/accesscontrol

    why they differ · A person is asking a worry question and needs the shape of the answer. A model is building a security comparison and needs `fails_closed` and `retrieval_filtered_pre_generation` as flags it can put in a table.

  • How is this different from an agent framework?

    What it is

    🧑 For humans

    A framework solves how the agent thinks: planning, tool loops, retries, evaluation. That is a real problem and frameworks solve it well. This solves what the agent has: a mailbox, a spend ledger, a corpus, permissions, an audit trail. They are complementary layers and you will probably want both.

    🤖 For bots

    Complementary, not competing. Frameworks provide the reasoning loop; AgentBag provides agent identity, storage, permissions and accounting. AgentBag does not provide planning or tool-selection logic.

    provides_reasoning_loop
    false
    provides_planning
    false
    provides_agent_identity
    true
    provides_audit_trail
    true
    replaces_agent_framework
    false
    composable_with_frameworks
    true

    sources:/compare/agent-frameworks

    why they differ · `replaces_agent_framework: false` is the single field that stops a model recommending us for a job we do not do. Stating it as a boolean is worth more than a paragraph of positioning.

  • What does acme.agentbag.ai actually mean?

    What it is

    🧑 For humans

    Every workspace is a tenant with its own subdomain. Isolation, routing and access resolution all hang off that boundary, which is why picking the address is the first step rather than a setting you find later.

    🤖 For bots

    Multi-tenant with subdomain-per-workspace addressing. The subdomain is the isolation and routing boundary.

    multi_tenant
    true
    tenant_addressing
    "subdomain"
    isolation_boundary
    "tenant_database"
    subdomain_max_length
    63
    subdomain_charset
    "a-z0-9-"
    reserve_url
    "/claim"

    sources:/claim

    why they differ · The bot answer carries the validation rules: max length, charset. The most useful thing an agent can do with this question is check whether its user's desired name is even legal.

  • What does this website collect about me?

    Evaluating it

    🧑 For humans

    One thing: whatever you type into the waitlist form. There is no analytics script, no advertising pixel, no session recording and no third-party tag on this site, which is a deliberate choice, given what the product argues for. Your theme preference stays in your browser.

    🤖 For bots

    Waitlist form submissions only. No analytics, no advertising pixels, no session recording, no third-party tags, no cookies set.

    analytics
    false
    advertising_pixels
    false
    session_recording
    false
    third_party_tags
    false
    cookies_set
    false
    collects_email
    true
    collection_surface
    "waitlist_form"

    sources:/privacy

    why they differ · Every value here is a boolean a privacy-checking agent can assert against. The human version needs the "and here is why" clause; the bot version would be weakened by it.

  • What is the fastest way to evaluate this properly?

    Evaluating it

    🧑 For humans

    Read the capability ledger at /status first, then push the on-page agent on the awkward questions. It answers only from that ledger and declines rather than speculating. Then look at /capabilities for the reach column. Reserve an address last, not first.

    🤖 For bots

    Fetch /api/modules for the ledger and /api/faq for these answers, then call tools/list at /api/mcp. No signup required to evaluate.

    signup_required_to_evaluate
    false
    demo_gated
    false
    ledger_endpoint
    "/api/modules"
    faq_endpoint
    "/api/faq"
    mcp_endpoint
    "/api/mcp"
    llms_txt
    "/llms.txt"

    sources:/status/capabilities/agents

    why they differ · The human path is a reading order. The bot path is four URLs, because an agent evaluating a vendor should not have to render a page to find out what the vendor does.

  • Why should I believe your status claims?

    Evaluating it

    🧑 For humans

    Because they cost us something. The ledger says a module is only a deep link, that we meter but do not charge, that voice does not include phone calls, and that our own single-writer guard script is not wired into CI yet. A vendor willing to publish those is a cheaper thing to verify than one who claims everything.

    🤖 For bots

    Claims are published per capability with explicit negative claims. The same data is served machine-readably and matches the rendered pages.

    publishes_negative_claims
    true
    machine_readable_ledger
    "/api/modules"
    capabilities_marked_not_built
    8
    capabilities_marked_beta
    32
    human_and_machine_data_identical
    true

    sources:/status/capabilities/api/modules

    why they differ · A person is deciding whether to trust a vendor. A model is deciding whether the page it just read can be cited. What it needs is confirmation that the machine data and the rendered data are the same data, which here they literally are.

Everything else

The rest of the questions.

Human answers only. These come straight from the module pages, where they also live.

Does my agent get a real email address? Mail
Yes: a per-agent mailbox address that external senders can write to. Inbound is delivered by provider webhook rather than by us operating mail servers.
What stops someone emailing my agent instructions? Mail
Inbound is classified and screened before it reaches the agent. Messages that look like instruction injection are quarantined, and what does get through is subject to the same trust and access rules as every other input.
Can the agent send mail without me seeing it? Mail
Outbound goes through an outbox with scheduling and cancellation, and owners can turn on a redacted digest of mailbox activity.
What is in a package? Package
The folder tree, every leaf document, the .context and .agent config files, workflows, and a manifest with contributor and provenance metadata. No credentials, no embeddings, no verification status.
Can I share a package with someone on a different account? Package
Yes. A private handoff link carries a time-expiring share token. The recipient installs it into their own account through the same plan-review-apply flow.
Does the agent remember our conversations? Memory
Not in the way "memory" usually implies. This is retrieval over material you supply. Conversation history is kept per session; it is not distilled into a persistent profile.
Why is this beta rather than live? Memory
The retrieval pipeline works. The vector grounding path is code-complete but its deployment and backfill are not finished, so we will not call it live.
Can the agent book a meeting for me? Calendar
It can hand someone a validated link to your booking tool. It cannot read your availability or write an event.
When will this be real? Calendar
We have not committed to a date, and we would rather leave this on the bench than put a quarter next to it.
What file types can it read? Docs
PDFs, CSVs and spreadsheet exports, plain text and markdown, and video transcripts. Anything outside that is stored but not extracted.
Where does an agent's behaviour get configured? Docs
In a config file inside the folder itself, with settings cascading down the tree. It is editable in the product and it is plain text.
Can I plug in my own MCP server? MCP
Yes: it becomes a connector with no bespoke code. Authentication is a static bearer token today; OAuth 2.1 for custom remote servers is planned.
Can other tools call my agent over MCP? MCP
Yes. The platform exposes an MCP server surface with OAuth, scopes and an approval policy.
Is this Kafka? Events
No. The in-process bus is a node-local typed emitter, and durability comes from a Postgres task ledger. If you need cross-cluster streaming, this is not that.
Can I see what an agent did? Events
Yes: a task timeline with events, delegation edges and artifacts, including the interventions taken against it.
Can my agent answer the phone? Phone
No. There is no inbound or outbound calling. Voice works in the browser; telephony is SMS-only and currently gated off.
Which languages does speech support? Phone
A broad set, with routing to different providers per language, including a dedicated provider for Indic languages where the general models underperform.
What is this actually protecting against? TrustGraph
One agent extracting from another something its owner never agreed to share: the multi-agent version of a permissions bug, which is the failure mode that scales worst.
Can I see why a request was denied? TrustGraph
Decisions are recorded per edge and visible to administrators. A richer end-user "why blocked" explanation is thinner than the enforcement behind it, and we would rather say so.
Can I make one document public and keep the rest private? AccessControl
Yes: policy is per leaf as well as per folder, and it applies to what the agent can retrieve, not only to what a browser can open.
How fast does a permission change take effect? AccessControl
Policy is cached per session for performance and invalidated on change. It is fast, but it is not a guarantee about requests already in flight.
Can I define my own taxonomy? Taxonomy
Not today. Tags are derived from your material rather than authored as a scheme. An authorable hierarchy is the obvious next step and is not built.
What happens to an out-of-scope question? Taxonomy
The classifier flags it before the model commits to an answer, so the agent can redirect rather than improvise.