Capability layer

One endpoint.
The right tools.

Agents get exactly the capabilities they need, with proof of who allowed it and what happened.

3 meta-tools644 capabilities1 endpoint

Your agent pays for every schema before it does anything.

Five connected servers can consume 72% of a 200k window before the first token of the actual task. The fix is not a larger window. It is not shipping schemas the model will never use.

Measured on a 644-operation Stripe-shaped catalog. 412 tokens until a capability is described.

Direct connections143,000 / 200,000

stripegithublinearnotionsnowflake

Laminaro endpoint412 / 200,000

0.2% of the window before the first call. The schema is paid for once, by the call that needs it.

Estimate

Put your own catalog on the scale.

The measurement is a 644-operation catalog: 143,000 tokens when every schema is loaded up front, 412 tokens at the endpoint before a capability is described.

Drag the catalog size to see the same ratio. This is an extrapolation from that measurement, not a promise about your API; the endpoint cost stays flat because the catalog is searched, not shipped.

Operations in the catalog644

Include one described schema (+600 tokens)

Direct connections143,000 / 200,000 · 71.5%

Laminaro endpoint1,012 / 200,000 · 0.51%

For this comparison

141,988 tokens saved99% of the direct load

Search. Describe. Invoke. Receipt.

The endpoint exposes three meta-tools and a typed SDK. The catalog can hold hundreds of operations; the agent sees a handful of words until it chooses.

Live sequence · pauses on hover

laminaro / acme-agentone catalog

context 412 / 200,00021ms

capabilities.search

request

{ "query": "refund an invoice", "kind": "tool" }

result

[
  { "ref": "invoices.refund", "requires": ["invoice", "amount"], "size": 34 },
  { "ref": "invoices.get",    "requires": ["invoice"],           "size": 28 },
  { "ref": "credits.issue",   "requires": ["customer", "amount"], "size": 31 }
]

playingevery call leaves this record

The grant is not the policy.

A capability can be granted and still be refused. Rules run at call time on the source, side-effect class, caller, time window and argument shape. Deny wins.

A production version cannot be granted until someone other than its author approves it. The run records which version, which caller, and what came back.

Bundles

A playbook pins the versions it was reviewed with.

A bundle is ordered instructions plus the exact capability versions each step may use. Granting it grants those pins and nothing else, so an upstream change cannot widen what an agent reaches.

ordered steps · each step names its capabilities
pins are (capability, version), not a moving tag
a new version pauses the grant until a non-author approves
bundles cannot nest, so the surface stays countable

create-an-orderv1.0.4granted

01
Find the invoice
invoices.get @1.2.0customers.get @3.0.1
02
Refund the invoice
invoices.refund @1.4.1
03
Post the ledger entry
ledger.post @2.0.0ledger.audit @1.0.3

grant resolves to 5 pinned capabilities · nothing else

v1.0.5 published

Approval pending. The grant still executes v1.0.4, so the new step cannot run until a person approves it.

Security

The agent never holds your upstream secret.

A Laminaro key proves which workspace and endpoint is calling. It is not the credential for your API. Four hops separate the two, and each one can refuse the call.

If a key leaks, revoke it. The upstream credential is not in the key, and the next call fails closed.

Step 01Agent key

Agent presents a scoped key

The key names the endpoints and tools it may call. It expires and can be revoked without touching your upstream.

Authorization: Bearer sk_live_…

Step 02Gateway

Gateway checks this call

Policy, approval and quota run now, not when the grant was made. One denial stops the call here.

policy · approval · quota

Step 03Credential

Laminaro unlocks the upstream key

Your upstream credential is encrypted at rest. Laminaro decrypts it inside the gateway, only for this call.

Authorization: Bearer <upstream credential>

Step 04Receipt

Upstream sees one call

The response returns to the agent. A receipt records the caller, pinned version, result and latency.

200 OK · run receipt

Agent holds

sk_live_…

Laminaro key · endpoint + tool scope · expiring · revocable

Laminaro holds

encrypted upstream credential

Decrypted for one call · never returned to the agent

Skill pipeline

A passing scan is evidence, not a guarantee.

Every published skill version runs the same deterministic checks before it can be granted. A blocking finding fails the version; the gate is the version, not a label someone applied once.

No scanner recognises every malicious pattern. That is why scripts also run in a fresh microVM with egress denied, a read-only tree and a wall-clock bound.

Archive
zip limits · path traversal · size and line caps
ClamAV
known-malware signatures · blocking
YARA
reverse shells · miners · web shells · blocking
Semgrep
SAST and secret rules
Gitleaks
committed credentials
Trivy
dependency CVEs

pass

Version is pinned. It still cannot be granted in production without a non-author approval.

block

The version stays unpublished and cannot be granted. The scan digest is kept for the record.

A purpose-built package fired EICAR, a reverse-shell YARA rule and two lodash CVEs: 7 blocking findings, scan failed, never granted.

Skills

A skill is a package you can version, scan and grant.

Create files directly in the console, edit the tree, and publish the whole tree as one immutable version. The entry stays short; references and assets are read by path, so a skill can stay deep without loading everything into the window.

author SKILL.md and its files in the console
publish an immutable version with a tree hash
scan the version before it can be pinned or granted
scripts run in a fresh VM · egress denied · read-only tree
rollback to a scan-passed version without rewriting history

The editor is single-writer today. Real-time multiplayer editing is being evaluated before it ships, because a merge that rewrites SKILL.md is a version event, not a text edit.

invoice-review

v1.4.0

Package files

SKILL.mdentry · 182 lines
scripts/reconcile.pyruns in a microVM
references/policy.mdread by path
assets/template.csvasset

scan passed · 0 blockingpinned · granted to staging

---
name: invoice-review
description: Reconcile an invoice against policy
---

Read references/policy.md, then run
scripts/reconcile.py with the invoice id.

Pricing

Start free. Pay for real traffic.

Every plan includes the governance layer: pinned versions, policies, non-author approvals and a receipt for every call.

Compare all plans

Free

$0forever

1 member · 1 workspace
1,000 MCP requests / month
10 sandbox minutes / month

Start free

Personal

Team

$25per member / month, 3+ members

3-seat minimum · $25 per seat
11+ seats $22 · 26+ seats $19
50,000 requests and 300 sandbox minutes per seat, pooled