allow
Runs freely. No prompt, no pause.
Product·Skills & Extensions
The workforce that compounds.
An agent is markdown at baseline — plus its tools, model, and a per-capability permission tree. A grant decides what it reaches: its machine, connectors, secrets, skills. A skill encodes how the company does one job. Both are files in your repo. Both are reviewed like code.
Agentmarkdown plus its grants
Skilla folder with SKILL.md
Governancedeny by default
Lands viaa change request to main
What an agent is
Two files. No hidden object behind them.
An agent has exactly two homes. The markdown file carries how it thinks — prompt, mode, model, permission tree. The grant block carries what it may touch. Nothing about an agent lives in a database you cannot read.
- Behavior stays in the agent file. Grants stay in the company repo. Mixing them is an error.
- Markdown is the floor, not the ceiling: your own tools, plugins, and model config sit beside it.
- A new project ships a generalist and a memory curator. Everything else you write.
Scoped reach
Deny by default. Never above the human.
The grant covers the whole surface, not just tools: which machine it boots, which connectors and channels it may call, which secrets it may receive, which skills it may invoke. An agent with no grants gets none of it. You grant explicitly, or the answer is no — and on top of that sits a ceiling nothing in the config can lift.
ask
Pauses for a human. The session waits for your answer.
deny
Blocked outright. Not a warning — a wall.
An agent never exceeds its human
The grant at session start is what the agent declares, intersected with the role of whoever launched it. Grant it everything and it still gets exactly your own permissions — no more, on any path.
Some things can never be granted
Account-level administration — members, billing, creating projects — is outside the set an agent can hold. There is no value you can write in a file that turns that on.
Secrets are named, not shown
The block lists secrets by identifier, never values. A session receives only the intersection of that grant and the role of whoever started it.
It cannot vote itself a raise
An agent can edit the grant file — it is a file. The edit only applies after a person merges the change request, and even then the ceiling still holds.
What a skill is
How your company does one job, written down once.
A skill is a directory with a SKILL.md at its root. Frontmatter names it and says when to reach for it; the body is the procedure. Every session can load it, so the thing you explained to one agent in March is still true for every agent in November.
- The description is the trigger — a vague one means the skill never fires
- The folder can carry scripts, references, and assets beside the markdown
- Granted, not global: a finance agent does not get the deploy runbook because it sat in the repo
The description is the trigger
An agent decides whether to load a skill from its name and description alone. Write it like the things a person would actually say.
More than prose
Scripts and assets ship with the instruction, so a procedure does not rot away from the thing it drives.
Granted, not global
The skills grant on an agent controls which skills it may load. Presence in the repo is not permission.
Everything is files
The workforce is in the diff.
Agents and skills are not rows in a table you cannot see. They are markdown in the repo the session clones, so changing your workforce is the same act as changing your code — and it gets the same review.
- Customize writes a branch, not a silent row. Create and edit open a session that files a change request.
- An agent can sharpen its own prompt or tighten a grant. A person merges it. Self-improvement, human-merged.
- Because it is text, you can fork the workforce, try different grants, roll it back, or hand it to a new project.
Bring a skill in
Start from someone else’s work. Own it immediately.
What arrives is files in your repo — not a dependency you rent. No lockfile, no version pin, no automatic update. That is deliberate.
Find it
Browse a template, a skill, or another project’s agent files. Nothing loads by default.
Add it
A session reads the source and merges what fits into your own files — rather than dropping a package and hoping.
It wires itself
If the item needs a key or a connected app, you get a fill-in link in the same turn. You never paste a credential into chat. The agent never sees the value.
You approve it
The session opens a change request. You read which files are about to join the company, and merge when you are happy. Nothing lands unreviewed.
Plugins & MCP
Extend the platform, not just the prompt
Plugins add new capabilities to Neuro OS itself — integrations, custom workflows, UI panels. MCP servers give agents live tools: your database, your CRM, your observability stack. Agents discover and use them like any other tool.
- Plugin SDK with a local development loop
- MCP tool discovery per agent, with permissions
- Integrations inherit governance: gates apply to tools too
Adapters
Bringing your own agent? That’s its own page
The runtimes that power your agents — Claude, Codex, Hermes and more, on your own keys — get their own home so this page can stay about what you build on top. Head there to wire up an adapter and pick the model behind each role.
- Claude, Codex, and Hermes via local or gateway adapters
- Your keys, your infrastructure, swappable per role
“Institutional knowledge shouldn’t live in one person’s head. Write the procedure down once as a skill — files in the repo, deny by default, and nothing joins main without a yes.”
Keep exploring
Product · Adapters
Bring Your Own Agent
Wire Claude, Codex, and Hermes into the org chart on your keys.
Learn more →Product · Org Chart
Org Chart for Agents
Roles, reporting lines, and real delegation for humans and agents.
Learn more →Product · Heartbeats
Agents That Keep Working
Wakes, watchdogs, and overnight progress between your prompts.
Learn more →Write it once. Every session knows it.
Book a meeting — we'll walk through skills, plugins, and MCP for your stack.