APIs
Two APIs. One gate.
The HTTP API runs OrchKernel. The governed actions API lets agents built elsewhere ask the kernel to act. Every request passes the same gate.
Two APIs
One runs the kernel. One lets outside agents in.
01
The HTTP API
Define agents, modules and rules through the API, or through the CLI. The workspace runs on it too.
02
The governed actions API
Agents built elsewhere get their own identity and ask the kernel to act. The answer is allowed, needs approval or denied, with the reason.
TypeScript and Python clientsA governed action
Your agent asks. The kernel acts.
Outside agents never hold your vendor keys. They ask for an action, and OrchKernel runs the approved action with its own credentials.
The request passes the same gate as the kernel's own agents: kill switches, arguments, delegation, budgets, rules, then risk against trust. It lands in the same tamper-evident log.
governed action (illustration)
Your agent
Refund $240 on Acme's last invoice, acting for Alice.
OrchKernel
Needs approval. Reason: your rule says refunds need an admin.
An admin
Approves, after seeing the exact payload.
OrchKernel
Runs the refund once, with its own Stripe connection. Your agent never sees the key.
Frequently Asked Questions
Put an agent on real work, with people in charge
Design partners run one real workflow on OrchKernel and work directly with the engineers building it.
OrchKernel is source-available and self-hosted.