Skip to content
phaiAI.tech
Agents

Agents you can read, review, pin and revoke.

Every PhaiAI agent is a versioned package, not a configuration screen. It carries a persona, a rule set, loadable skills, a declared MCP surface, a manifest and a control policy — published to the Agyle marketplace, installed through a declared apm manifest, and governed on the wire by the Agent Control Standard.

personarulesskillsmcp.jsonAGENTS.mdacs.policy.yaml
Catalogue

The agent catalogue.

Five agents that move work through the lifecycle, and two that keep the other five honest. Hover a card for the shape of the package; open it for the persona, the rules, the skills, the MCP servers it is entitled to reach, the manifest and the hooks it runs behind.

How they fit together

One line, orchestrated above and grounded below.

Agents in isolation produce output. Agents sequenced by path definitions and grounded in shared domain context produce delivery. The orchestration layer and the context layer are what turn five capable agents into one dependable line.

Fig. 1The PhaiAI agent line. Five domain-focused agents, sequenced by agentic workflows above and grounded by a Domain Context Engine below. Neither the orchestration nor the context is optional — an agent without either is a demo. Click to enlarge.
Anatomy

What is inside an agent package.

Context is treated as code. These files are diffable, peer-reviewed, released under semantic versioning and pinned by content hash — because an agent whose behaviour cannot be traced to a reviewed file is an agent nobody can be accountable for.

Fig. 2Every PhaiAI agent ships as a versioned, reviewable package. Context is treated as code: peer-reviewed, diffable, and pinned by content hash at install time. Click to enlarge.

Persona

persona.md

Who the agent is, what it is for, and — more importantly — what it refuses. Role definition anchors behaviour; explicit refusal boundaries are the first line of defence against an agent being talked into something it should not do.

rolevoicescoperefusal_boundaries[]escalation_triggers[]

Rules

rules/*.md

The non-negotiables. Rules are not polite guidance in a system prompt — they are enforced in three places at once: in the prompt, at the gate, and at the Guardian. An agent cannot reason its way past a rule it has no capability to break.

invariantsforbidden_actions[]required_evidence[]allowlists

Skills

skills/*/SKILL.md

Composable procedures loaded on demand rather than pasted into every prompt. Keeping them separate is what keeps the context window spent on the problem instead of on instructions the agent does not need yet.

trigger conditionsproceduretools requiredworked examples

MCP surface

mcp.json

Persona, rules and skills decide how an agent thinks; MCP decides what it can reach. The package declares its Model Context Protocol servers, the tools and resources it needs from each, and the entitlement it is willing to run with — so an agent's blast radius is a reviewable property of the package rather than an accident of whoever set up the harness.

servers[]tools_allowed[]resources[]scopetransport

Agent manifest

AGENTS.md

The constitution: stack, commands, conventions, inputs, outputs, handoff contract and definition of done. It is version-controlled, peer-reviewed, and the one file every harness reads first.

charterinputs/outputscommandsboundariesdefinition_of_done

Control policy

acs.policy.yaml

The governance half of the package: which lifecycle hooks are instrumented, what the Guardian is expected to do at each one, and what gets emitted to the audit trail. Shipped with the agent, not bolted on per deployment.

hooks[]dispositionsfailure_posturetrace_profileagbom

Why six files and not one prompt

Because each file has a different review audience and a different change cadence. A domain lead owns the rules. An engineer owns the skills. A platform owner owns the MCP surface. A security reviewer owns the control policy. Collapsing them into one prompt means every change needs everyone's approval — which in practice means nobody reviews any of it.

It also means an agent can be audited by reading, before it is trusted by running.

MCP surface

What the agent can reach is part of the package.

Most agent incidents are not reasoning failures — they are reach failures. An agent that can call anything eventually calls something it should not have. So the Model Context Protocol servers an agent needs are declared in the package next to its rules, resolved through a tool gateway at bind time, and narrowed to the smallest set of tools that still lets the path finish.

Fig. 3The MCP surface. Persona, rules and skills decide how an agent thinks; its declared MCP servers decide what it can reach. Nothing undeclared resolves, and nothing declared executes without passing the Guardian first. Click to enlarge.

Declared, not configured

The servers an agent needs live in the package and travel with it. Installing the agent in a new repo does not mean rediscovering which tools it expects, and reviewing the agent means reviewing its reach at the same time as its rules.

Least tools, not least servers

Entitlement is per tool, not per server. The Development Agent reaches GitHub, but only to read files, cut a branch and open a pull request — it holds no capability to merge, to change branch protection, or to touch repository settings.

Every call is a decision point

MCP gives the agent reach; the Agent Control Standard decides whether to use it. Each tool call raises a PreToolUse hook the Guardian can allow, deny, modify, or escalate to a human — synchronously, before the side effect exists.

The servers our agents actually run with

These are defaults, not a lock-in. Where you already run a different issue tracker, observability stack or scanner, the group stays and the server swaps — the persona, rules and skills do not change, because they were never written against a vendor.

Work intake and specification

Solution

The ticket, the thread and the space that owns the decision. Reading the whole conversation is usually what separates a spec from a restatement of the title.

atlassian/atlassian-mcp-serverlinear/linear-mcpasdlc.io/mcp

Code and documentation

Development · BugFix

Repository access narrowed to a feature branch, a sandboxed workspace filesystem, and version-correct library docs so the agent stops writing against an API that changed two releases ago.

github/github-mcp-servermodelcontextprotocol/server-filesystemupstash/context7-mcp

Verification

Testing

Browser-driven acceptance checks plus static and dependency analysis, delivered into the same review turn as the diff instead of into a report nobody opens.

microsoft/playwright-mcpsemgrep/mcpsnyk/snyk-mcp

Operate and observe

Deployment · BugFix

Plan-only infrastructure access, namespace-scoped rollout control, and read access to the metrics, traces and error signals that decide whether a release continues or halts.

hashicorp/terraform-mcp-serverkubernetes/mcp-servergrafana/mcp-grafanagetsentry/sentry-mcp

Domain memory

All agents · Context Curator

The Domain Context Engine exposed as MCP, with the memory tools underneath it. This is the group that makes the other four safe to narrow: an agent that can recall does not need to browse.

phaiai/domain-context-enginetopoteretes/cognee-mcpsupermemoryai/supermemory-mcpvectorize-io/hindsight-mcp

Governance

Guardian

The control plane the other servers are mediated by: the ACS hook endpoint, the entitlement registry and the telemetry bridge that makes the audit trail reconstructable.

phaiai/guardian-acsmicrosoft/agent-governance-toolkitphaiai/tool-gateway
mcp.jsonjson
{
  "agent": "phaiai/agents/domain-development",
  "servers": {
    "domain-context": {
      "id": "phaiai/domain-context-engine",
      "transport": "stdio",
      "tools_allowed": ["search_context", "get_adr", "get_spec"],
      "scope": { "bounded_context": "payments", "mode": "read" }
    },
    "github": {
      "id": "io.github.github/github-mcp-server",
      "transport": "http",
      "tools_allowed": [
        "get_file_contents", "create_branch",
        "create_or_update_file", "create_pull_request"
      ],
      "scope": { "repos": ["acme/payments-*"], "branches": "feat/**" }
    },
    "context7": {
      "id": "io.github.upstash/context7-mcp",
      "tools_allowed": ["resolve-library-id", "get-library-docs"],
      "scope": { "mode": "read" }
    }
  },
  "default": "deny"
}

Declared is not the same as trusted

An MCP server is an untrusted boundary even when we wrote it. Tool descriptions are data, not instructions; returned content is data, not instructions. Every response crosses a PostToolUse hook before it is allowed to influence the next turn, which is where indirect prompt injection gets caught rather than obeyed.
Domain Context Engines

Every agent ships wired into domain memory.

This is the integration that makes an agent domain-focused rather than merely competent. Agents without sufficient information do not fail loudly — they proceed on incomplete assumptions, confidently. A Domain Context Engine is how we stop that being the default.

Fig. 4A Domain Context Engine is not a vector database with a nice name. It is a governed memory system, assembled on next-generation memory tooling, that answers a specific domain's questions in that domain's language. Click to enlarge.

Built on next-generation memory tooling

We do not build memory from scratch, and we do not pretend one engine suits every domain. The substrate is chosen from the domain's actual shape — what its knowledge looks like, where it lives, how fast it moves, and what the compliance posture permits — and then wrapped in the ontology, provenance and lifecycle discipline that makes it trustworthy.

The integration is intelligent, not incidental

Retrieval is scoped to the agent's bounded context, every returned fact carries its provenance, memory reads and writes pass the same Guardian hooks as any other action, and a Context Curator Agent reconciles written context against the running system on a schedule. Stale context retrieved with confidence is worse than no context at all.
  • Cognee

    Decades of documents, not conversations

    Knowledge-graph construction as a pipeline across relational, vector and graph stores. Ingests repos, specs, warehouses and multimodal sources into typed entities and relations. Our default where the domain's truth is written down but scattered.

    reference ↗

  • Supermemory

    Weeks to value, not quarters

    A managed engine covering extraction, graph linking, versioning, expiry and standing profiles behind one API, with hybrid retrieval in a single call. Container tags partition memory per domain, project or agent with scoped keys.

    reference ↗

  • Hindsight

    Reasoning over history, self-hosted

    Typed facts — world, experience, opinion, observation — linked temporally, semantically and causally, with retain / recall / reflect as explicit operations and confidence that evolves as evidence arrives. Runs on Postgres with pgvector.

    reference ↗

Domain Context Engines are assembled on Cognee, Supermemory and Hindsight (Latimer et al., Vectorize and Virginia Tech), all credited to their authors. The domain-driven framing — domain-aligned boundaries, ubiquitous language in platform APIs, bounded contexts with anti-corruption layers — follows Ajay Chankramath's research interview on domain-driven platform engineering.

Agyle

A marketplace for agent packages, not a walled garden.

Agyle is PhaiAI's agent marketplace. It hosts agent packages built on the Agent Package Manager (apm) format, so anything published there can be installed by anyone, on any agentic harness, through a manifest their repo already reviews.

Fig. 5Agyle distribution. An agent is authored once, gated once, published once — then installed by any harness through a declared manifest, with policy enforced before a single file touches disk. Click to enlarge.

Portable by manifest

One apm.yml, reviewed with the repo. A fresh clone resolves the same package content byte for byte, because the lockfile pins exact versions and content hashes.

Secure by default

Every install scans for hidden Unicode, pins content hashes, and blocks transitive MCP servers unless explicitly declared or trusted. No opt-in required, because security that needs enabling does not get enabled.

Governed by policy

apm-policy.yml is enforced at install time, including transitive MCP servers. Tighten-only inheritance flows from enterprise to org to repo, so a team can be stricter than the enterprise but never looser.

Harness-agnostic

The same package installs into Cursor, Claude Code, Codex, GitHub Copilot, Gemini, OpenCode, Windsurf or Kiro. Each harness receives the primitives it supports; nobody is asked to standardise on one vendor's editor.

The packaging, policy and lockfile behaviour described here is provided by APM, the Agent Package Manager, an open Microsoft project. Agyle is a registry and a review process on top of it — we did not reinvent the dependency manager, and we would rather publish into an ecosystem than build another silo.

apm.ymlyaml
name: payments-platform
version: 2.4.0

dependencies:
  apm:
    # PhaiAI agents, pinned by tag and verified by content hash
    - phaiai/agents/domain-solution#v1.6.0
    - phaiai/agents/domain-development#v2.3.1
    - phaiai/agents/domain-testing#v2.1.4
    - phaiai/agents/deployment#v1.9.2
    - phaiai/agents/bugfix#v2.0.0

    # domain overlay: your rules win over ours
    - git: https://git.acme.internal/payments/agent-rules.git
      path: rules/pci-dss
      ref: v4.1

  # MCP servers the agents are entitled to reach
  mcp:
    - phaiai/domain-context-engine
    - io.github.github/github-mcp-server
    - io.github.microsoft/playwright-mcp
    - io.github.getsentry/sentry-mcp
terminal
$ apm install
  resolving   9 packages, 4 mcp servers
  policy      apm-policy.yml (enterprise → org → repo)
  scanning    hidden unicode … clean
  mcp         transitive servers … 0 undeclared
  pinning     content hashes → apm.lock
  deploying   cursor · claude-code · codex · copilot

  ✓ 9 packages installed, 0 policy violations
Governance

Every agent is governed by the Agent Control Standard.

Distribution without control is just faster proliferation. Each package in Agyle declares the lifecycle hooks it is instrumented for, and at runtime a separate Guardian inspects what the agent is about to do and permits, denies or modifies it — before it happens, over an authenticated channel, with an audit trail that reconstructs after the fact.

The agent asks before it acts

A hook is a point in execution where the agent stops and asks. ACS defines sixteen native lifecycle hooks — session start and end, before and after each turn, on knowledge retrieval, and around every memory read and write, as well as tool call request and result. The Guardian answers with exactly one of five dispositions: allow, deny, modify, ask or defer.

Policy is deterministic first

The deterministic layer — a policy engine such as OPA/Rego or Cedar — always runs first and always runs last. A model layer may be consulted when policy cannot resolve a request alone, but it never reads the policy source and its answer still has to clear the deterministic layer on the way out. Deterministic-only deployments are fully conformant; delegation is optional.

Inventory, not inference

Every agent we publish can emit an AgBOM: a live inventory of its models, tools and dependencies, serialised as CycloneDX, SPDX or SWID. When someone asks which agents in the estate can reach the payments database, the answer is a query rather than a meeting.

acs.policy.yamlyaml
acs_version: "0.1.0"
agent_id: phaiai/agents/domain-development

conformance:
  core: true              # Instrument + wire + audit chain
  profiles: [trace, inspect]

failure_posture: deny     # never proceed when the Guardian is unreachable

hooks:
  session/start:
    emit: [agbom, identity_binding]
  knowledge/retrieve:
    scope: bounded_context.payments
    deny_if: source.provenance == null
  memory/write:
    require: [provenance, lifetime]
    strip_tokens: ["ignore previous", "system:", "from now on"]
  steps/toolCallRequest:
    allow: [gh, make, pytest, ruff, domain-context]
    modify:
      database_query: { max_rows: 100 }
    ask:
      - tool: gh
        args_match: { subcommand: "pr merge" }
    deny:
      - tool: shell
        args_match: { destructive: true }
      - target: [ci_config, secrets, deploy_pipeline]

trace:
  otel: true
  ocsf: true
  attribute: [agent_id, session_id, cost_tokens, disposition, reason_code]

Hooks, dispositions, the deterministic-first decision chain, the Instrument / Trace / Inspect pillars and the AgBOM are defined by the Agent Control Standard, an open project of the OWASP GenAI Security Project. ACS v0.1.0 is an early specification and states its own gaps openly; we implement against it, track its milestones, and do not claim conformance we have not tested. The policy excerpt above is illustrative.

Want these agents speaking your domain?

The packages are the starting point, not the deliverable. We fork them against your bounded context, stand up the Domain Context Engine behind them, encode your rules as rules, and hand back something your team owns and can read.