Agents you can read, review, pin and revoke.
Every PhaiAI agent is a versioned package, not a configuration screen. It carries a persona, a rule set, loadable skills, a declared MCP surface, a manifest and a control policy — published to the Agyle marketplace, installed through a declared apm manifest, and governed on the wire by the Agent Control Standard.
The agent catalogue.
Five agents that move work through the lifecycle, and two that keep the other five honest. Hover a card for the shape of the package; open it for the persona, the rules, the skills, the MCP servers it is entitled to reach, the manifest and the hooks it runs behind.
One line, orchestrated above and grounded below.
Agents in isolation produce output. Agents sequenced by path definitions and grounded in shared domain context produce delivery. The orchestration layer and the context layer are what turn five capable agents into one dependable line.
What is inside an agent package.
Context is treated as code. These files are diffable, peer-reviewed, released under semantic versioning and pinned by content hash — because an agent whose behaviour cannot be traced to a reviewed file is an agent nobody can be accountable for.
Persona
persona.mdWho the agent is, what it is for, and — more importantly — what it refuses. Role definition anchors behaviour; explicit refusal boundaries are the first line of defence against an agent being talked into something it should not do.
rolevoicescoperefusal_boundaries[]escalation_triggers[]Rules
rules/*.mdThe non-negotiables. Rules are not polite guidance in a system prompt — they are enforced in three places at once: in the prompt, at the gate, and at the Guardian. An agent cannot reason its way past a rule it has no capability to break.
invariantsforbidden_actions[]required_evidence[]allowlistsSkills
skills/*/SKILL.mdComposable procedures loaded on demand rather than pasted into every prompt. Keeping them separate is what keeps the context window spent on the problem instead of on instructions the agent does not need yet.
trigger conditionsproceduretools requiredworked examplesMCP surface
mcp.jsonPersona, rules and skills decide how an agent thinks; MCP decides what it can reach. The package declares its Model Context Protocol servers, the tools and resources it needs from each, and the entitlement it is willing to run with — so an agent's blast radius is a reviewable property of the package rather than an accident of whoever set up the harness.
servers[]tools_allowed[]resources[]scopetransportAgent manifest
AGENTS.mdThe constitution: stack, commands, conventions, inputs, outputs, handoff contract and definition of done. It is version-controlled, peer-reviewed, and the one file every harness reads first.
charterinputs/outputscommandsboundariesdefinition_of_doneControl policy
acs.policy.yamlThe governance half of the package: which lifecycle hooks are instrumented, what the Guardian is expected to do at each one, and what gets emitted to the audit trail. Shipped with the agent, not bolted on per deployment.
hooks[]dispositionsfailure_posturetrace_profileagbomWhy six files and not one prompt
Because each file has a different review audience and a different change cadence. A domain lead owns the rules. An engineer owns the skills. A platform owner owns the MCP surface. A security reviewer owns the control policy. Collapsing them into one prompt means every change needs everyone's approval — which in practice means nobody reviews any of it.
It also means an agent can be audited by reading, before it is trusted by running.
What the agent can reach is part of the package.
Most agent incidents are not reasoning failures — they are reach failures. An agent that can call anything eventually calls something it should not have. So the Model Context Protocol servers an agent needs are declared in the package next to its rules, resolved through a tool gateway at bind time, and narrowed to the smallest set of tools that still lets the path finish.
Declared, not configured
The servers an agent needs live in the package and travel with it. Installing the agent in a new repo does not mean rediscovering which tools it expects, and reviewing the agent means reviewing its reach at the same time as its rules.
Least tools, not least servers
Entitlement is per tool, not per server. The Development Agent reaches GitHub, but only to read files, cut a branch and open a pull request — it holds no capability to merge, to change branch protection, or to touch repository settings.
Every call is a decision point
MCP gives the agent reach; the Agent Control Standard decides whether to use it. Each tool call raises a PreToolUse hook the Guardian can allow, deny, modify, or escalate to a human — synchronously, before the side effect exists.
The servers our agents actually run with
These are defaults, not a lock-in. Where you already run a different issue tracker, observability stack or scanner, the group stays and the server swaps — the persona, rules and skills do not change, because they were never written against a vendor.
Work intake and specification
SolutionThe ticket, the thread and the space that owns the decision. Reading the whole conversation is usually what separates a spec from a restatement of the title.
atlassian/atlassian-mcp-serverlinear/linear-mcpasdlc.io/mcpCode and documentation
Development · BugFixRepository access narrowed to a feature branch, a sandboxed workspace filesystem, and version-correct library docs so the agent stops writing against an API that changed two releases ago.
github/github-mcp-servermodelcontextprotocol/server-filesystemupstash/context7-mcpVerification
TestingBrowser-driven acceptance checks plus static and dependency analysis, delivered into the same review turn as the diff instead of into a report nobody opens.
microsoft/playwright-mcpsemgrep/mcpsnyk/snyk-mcpOperate and observe
Deployment · BugFixPlan-only infrastructure access, namespace-scoped rollout control, and read access to the metrics, traces and error signals that decide whether a release continues or halts.
hashicorp/terraform-mcp-serverkubernetes/mcp-servergrafana/mcp-grafanagetsentry/sentry-mcpDomain memory
All agents · Context CuratorThe Domain Context Engine exposed as MCP, with the memory tools underneath it. This is the group that makes the other four safe to narrow: an agent that can recall does not need to browse.
phaiai/domain-context-enginetopoteretes/cognee-mcpsupermemoryai/supermemory-mcpvectorize-io/hindsight-mcpGovernance
GuardianThe control plane the other servers are mediated by: the ACS hook endpoint, the entitlement registry and the telemetry bridge that makes the audit trail reconstructable.
phaiai/guardian-acsmicrosoft/agent-governance-toolkitphaiai/tool-gateway{
"agent": "phaiai/agents/domain-development",
"servers": {
"domain-context": {
"id": "phaiai/domain-context-engine",
"transport": "stdio",
"tools_allowed": ["search_context", "get_adr", "get_spec"],
"scope": { "bounded_context": "payments", "mode": "read" }
},
"github": {
"id": "io.github.github/github-mcp-server",
"transport": "http",
"tools_allowed": [
"get_file_contents", "create_branch",
"create_or_update_file", "create_pull_request"
],
"scope": { "repos": ["acme/payments-*"], "branches": "feat/**" }
},
"context7": {
"id": "io.github.upstash/context7-mcp",
"tools_allowed": ["resolve-library-id", "get-library-docs"],
"scope": { "mode": "read" }
}
},
"default": "deny"
}Declared is not the same as trusted
PostToolUse hook before it is allowed to influence the next turn, which is where indirect prompt injection gets caught rather than obeyed.Every agent ships wired into domain memory.
This is the integration that makes an agent domain-focused rather than merely competent. Agents without sufficient information do not fail loudly — they proceed on incomplete assumptions, confidently. A Domain Context Engine is how we stop that being the default.
Built on next-generation memory tooling
We do not build memory from scratch, and we do not pretend one engine suits every domain. The substrate is chosen from the domain's actual shape — what its knowledge looks like, where it lives, how fast it moves, and what the compliance posture permits — and then wrapped in the ontology, provenance and lifecycle discipline that makes it trustworthy.
The integration is intelligent, not incidental
Cognee
Decades of documents, not conversationsKnowledge-graph construction as a pipeline across relational, vector and graph stores. Ingests repos, specs, warehouses and multimodal sources into typed entities and relations. Our default where the domain's truth is written down but scattered.
Supermemory
Weeks to value, not quartersA managed engine covering extraction, graph linking, versioning, expiry and standing profiles behind one API, with hybrid retrieval in a single call. Container tags partition memory per domain, project or agent with scoped keys.
Hindsight
Reasoning over history, self-hostedTyped facts — world, experience, opinion, observation — linked temporally, semantically and causally, with retain / recall / reflect as explicit operations and confidence that evolves as evidence arrives. Runs on Postgres with pgvector.
Domain Context Engines are assembled on Cognee, Supermemory and Hindsight (Latimer et al., Vectorize and Virginia Tech), all credited to their authors. The domain-driven framing — domain-aligned boundaries, ubiquitous language in platform APIs, bounded contexts with anti-corruption layers — follows Ajay Chankramath's research interview on domain-driven platform engineering.
A marketplace for agent packages, not a walled garden.
Agyle is PhaiAI's agent marketplace. It hosts agent packages built on the Agent Package Manager (apm) format, so anything published there can be installed by anyone, on any agentic harness, through a manifest their repo already reviews.
Portable by manifest
One apm.yml, reviewed with the repo. A fresh clone resolves the same package content byte for byte, because the lockfile pins exact versions and content hashes.
Secure by default
Every install scans for hidden Unicode, pins content hashes, and blocks transitive MCP servers unless explicitly declared or trusted. No opt-in required, because security that needs enabling does not get enabled.
Governed by policy
apm-policy.yml is enforced at install time, including transitive MCP servers. Tighten-only inheritance flows from enterprise to org to repo, so a team can be stricter than the enterprise but never looser.
Harness-agnostic
The same package installs into Cursor, Claude Code, Codex, GitHub Copilot, Gemini, OpenCode, Windsurf or Kiro. Each harness receives the primitives it supports; nobody is asked to standardise on one vendor's editor.
The packaging, policy and lockfile behaviour described here is provided by APM, the Agent Package Manager, an open Microsoft project. Agyle is a registry and a review process on top of it — we did not reinvent the dependency manager, and we would rather publish into an ecosystem than build another silo.
name: payments-platform
version: 2.4.0
dependencies:
apm:
# PhaiAI agents, pinned by tag and verified by content hash
- phaiai/agents/domain-solution#v1.6.0
- phaiai/agents/domain-development#v2.3.1
- phaiai/agents/domain-testing#v2.1.4
- phaiai/agents/deployment#v1.9.2
- phaiai/agents/bugfix#v2.0.0
# domain overlay: your rules win over ours
- git: https://git.acme.internal/payments/agent-rules.git
path: rules/pci-dss
ref: v4.1
# MCP servers the agents are entitled to reach
mcp:
- phaiai/domain-context-engine
- io.github.github/github-mcp-server
- io.github.microsoft/playwright-mcp
- io.github.getsentry/sentry-mcp$ apm install
resolving 9 packages, 4 mcp servers
policy apm-policy.yml (enterprise → org → repo)
scanning hidden unicode … clean
mcp transitive servers … 0 undeclared
pinning content hashes → apm.lock
deploying cursor · claude-code · codex · copilot
✓ 9 packages installed, 0 policy violationsEvery agent is governed by the Agent Control Standard.
Distribution without control is just faster proliferation. Each package in Agyle declares the lifecycle hooks it is instrumented for, and at runtime a separate Guardian inspects what the agent is about to do and permits, denies or modifies it — before it happens, over an authenticated channel, with an audit trail that reconstructs after the fact.
The agent asks before it acts
A hook is a point in execution where the agent stops and asks. ACS defines sixteen native lifecycle hooks — session start and end, before and after each turn, on knowledge retrieval, and around every memory read and write, as well as tool call request and result. The Guardian answers with exactly one of five dispositions: allow, deny, modify, ask or defer.
Policy is deterministic first
The deterministic layer — a policy engine such as OPA/Rego or Cedar — always runs first and always runs last. A model layer may be consulted when policy cannot resolve a request alone, but it never reads the policy source and its answer still has to clear the deterministic layer on the way out. Deterministic-only deployments are fully conformant; delegation is optional.
Inventory, not inference
Every agent we publish can emit an AgBOM: a live inventory of its models, tools and dependencies, serialised as CycloneDX, SPDX or SWID. When someone asks which agents in the estate can reach the payments database, the answer is a query rather than a meeting.
acs_version: "0.1.0"
agent_id: phaiai/agents/domain-development
conformance:
core: true # Instrument + wire + audit chain
profiles: [trace, inspect]
failure_posture: deny # never proceed when the Guardian is unreachable
hooks:
session/start:
emit: [agbom, identity_binding]
knowledge/retrieve:
scope: bounded_context.payments
deny_if: source.provenance == null
memory/write:
require: [provenance, lifetime]
strip_tokens: ["ignore previous", "system:", "from now on"]
steps/toolCallRequest:
allow: [gh, make, pytest, ruff, domain-context]
modify:
database_query: { max_rows: 100 }
ask:
- tool: gh
args_match: { subcommand: "pr merge" }
deny:
- tool: shell
args_match: { destructive: true }
- target: [ci_config, secrets, deploy_pipeline]
trace:
otel: true
ocsf: true
attribute: [agent_id, session_id, cost_tokens, disposition, reason_code]Hooks, dispositions, the deterministic-first decision chain, the Instrument / Trace / Inspect pillars and the AgBOM are defined by the Agent Control Standard, an open project of the OWASP GenAI Security Project. ACS v0.1.0 is an early specification and states its own gaps openly; we implement against it, track its milestones, and do not claim conformance we have not tested. The policy excerpt above is illustrative.
Want these agents speaking your domain?
The packages are the starting point, not the deliverable. We fork them against your bounded context, stand up the Domain Context Engine behind them, encode your rules as rules, and hand back something your team owns and can read.