Developers

One file in.
A running agent out.

Write a spec, run one command. Kodeus provisions the runtime, holds the credentials, invokes the tools, handles retries and meters the usage.

Quickstart → API surface

terminal · preview

$ pip install kodeus
$ kodeus init support-agent   # guided spec generation
$ cd support-agent            # edit kodeus.yaml, add skills/
$ kodeus create               # draft and validate the application
$ kodeus run --dev            # start the runtime locally
$ kodeus chat                 # talk to your application

How the pieces fit together

You author locally. We draft and validate. The runtime executes, in your infrastructure or ours.

Piece	What it does	Where it runs
CLI & SDK	Authoring, guided specification generation, validation, local dev loop	Your machine
Managed services	Specification drafting, capability catalog, usage metering	Managed
Runtime	Execution, memory, identity, policy, observability	Your infrastructure, or managed hosting

Runtime conversations, user data and credentials stay inside the environment you deploy into.

kodeus.yaml

name: support-agent
role: A calm, precise customer support agent.

model:
  provider: anthropic       # per-agent selection

tools:
  - zendesk
  - gmail: require-user-oauth

memory:
  scope: per-user
  store: postgres

policy:
  guardrails: [pii-redaction, prompt-injection]
  approvals: [refund, account-deletion]

Quickstart

What goes in a spec file

The same specification that runs on your laptop is the artifact you deploy to production.

init captures intent, role, goals and tools through guided specification generation.
create drafts the application: a model, suggested MCP servers, scaffolded skills to refine.
run launches the runtime locally against your own database.
sync pushes model, skill and tool changes without a full redraft.

Join the early-access list

Attach a tool in one command

Any MCP server, plus three ways to handle whose credentials it uses.

User-supplied

Per-user environment

Each user supplies their own token, encrypted with a per-user key.

Delegated

Per-user OAuth

The user connects their own account; Kodeus holds and refreshes the grant.

Deployment-wide

Project-shared

One credential the whole deployment uses, held in an encrypted vault.

attaching tools

$ kodeus mcp add gmail --require-user-oauth "gmail:Connect your Google account"
$ kodeus mcp add zendesk --require-user-env "ZENDESK_TOKEN:Your Zendesk API token"
$ kodeus mcp add --transport streamable_http --url "https://tools.internal/mcp"

APIs and integrations

HTTP streaming API Stream a conversation, or call it request/response.

MCP tool integration Attach any MCP server; the registry makes it discoverable.

Agent-as-MCP Expose your application as an MCP server other systems can call.

Agent-to-agent transports Applications coordinate directly, without losing identity or state.

Where policy can step in

A turn-level policy mechanism intercepts work at five seams. Forty-five built-in guardrails ship with the platform and are enabled per application by policy.

Monitor Record without interrupting the turn.

Redact Strip sensitive content before it moves on.

Block Refuse the action outright.

Escalate Route the exception to someone who can decide.

Require approval Hold execution at a human-in-the-loop gate.

Be among the first to build on it

The CLI is in private preview. Early-access teams get it first, along with a direct line to the people building it.

Get early access → Read the architecture

One file in.A running agent out.