Open-source agent tooling by Kai Ase Siren. An agent is only as safe as the surface you hand it, so here the surface is declared in a config file and enforced at the call.
 Declare what a tool may run. Arguments are validated before the process starts, each verb needs its own scope token, and every call lands in an append-only audit log. The umbra driver builds the guarded CLI from that declaration, so there is no hand-written boundary code to get wrong. |
 One guardfile in, one guarded MCP server out. An operation nobody declared has no tool and no endpoint, so the blast radius of a write-capable MCP is one small file you can read end to end. |
 A role is context, never permission. The composed bundle is plain files you can read and diff before a run, and it grants no credential, mount, or command. Claude Code, Codex, Goose and OpenCode take the same one. |
housecast // roster.yaml - Agent context, cast from one rosterOne YAML file declares every role. The bundle an agent gets and the scorecard that grades it are cast from that file, so the graded artifact and the shipped artifact are identical. |
brew tap coilyco-flight-deck/tap https://forgejo.coilysiren.me/coilyco-flight-deck/homebrew-tap
brew install coilyco-flight-deck/tap/agent-composescoop bucket add coilyco-flight-deck https://forgejo.coilysiren.me/coilyco-flight-deck/scoop-bucket
scoop install coilyco-flight-deck/agent-composeumbra and aos install the same way from the same tap or bucket. mcp-beaver
is not a CLI, and ships as an image and a Helm chart.
MCP servers. Small, read-only, each stating its exact tool inventory and what it refuses to do: bluesky-mcp for authenticated Bluesky with no write tool at all, node-stats-mcp for node-local Linux and Kubernetes diagnostics, and lunch-money-k8s for the Lunch Money API.
Underneath. agentic-os is the host layer the rest of this runs on, a reference implementation rather than something to adopt. agent-proxy is the observability and trajectory data plane, in active transition, so its interfaces are unstable. homebrew-tap and scoop-bucket are the distribution channels.
Retired, kept for the record. ward, the governed execution layer that preceded this stack, and reddit-mcp. Retired work is archived here and removed from Forgejo, so GitHub carries the record.
Forgejo is canonical for development, issues, and releases. GitHub is a verified mirror and the right place to file a public bug.
