Your AI agents act. You stay in control.

AI agents no longer just write code or answer email: they scale a deployment, restart a service, call a billing API. And to let them do it, today they are almost always given the same thing you would give a trusted colleague: a kubeconfig, an API key or a service token.

The problem is that an agent with the credential is an agent with the keys. It can do anything that credential allows, on any resource, and a well-placed prompt injection is enough to make it happen. Nobody decides beforehand; you find out afterwards, if at all. And when someone asks which model asked for it, why, and what the system answered, there is nothing to show.

That is why we built Ploybot AI agents.

An authority layer between the agent and the system

Ploybot sits in the middle. The agent no longer carries the credential: it carries its identity. When it wants to do something, it asks, and the request always follows the same path:

1. Identity. Who is asking: the agent with its token, a workload identity, or a person’s session.
2. Capability. What it is asking for, from the catalogue you defined: scale, deploy, invoke an operation, read logs.
3. Policy. Declarative rules, evaluated in order. The first one that matches decides.
4. Approval, when needed. A person gets a notification on their phone with the change, the agent’s reason and the risk in front of them, and decides. For critical actions, they sign with their passkey.
5. Authorisation. Bound to that exact operation: five minutes and a single use. Change one replica and it no longer applies.
6. Gateway. The only component that sees the credential. It can run with us or inside your own network.
7. Evidence. Every step is recorded, hash-chained and verifiable.

The flow is the same whether the other side is a Kubernetes cluster, a REST API, a SOAP service, a gRPC service or a third-party MCP server.

Policy handles the routine; a person handles the sensitive

Nobody should have to approve every log read. Policy lives next to each capability and is written once: in development, let the agent work; in production, let a person decide. A typo in a rule is rejected when the rule is created, not on the day it should have denied something.

When a decision is needed, the notification reaches whoever has to make it. They can approve this once or for a while, and the agent retries on its own. What they cannot do is reuse an approval for a different operation.

Evidence an auditor can check

Every action leaves its own record: which agent and which model asked for it, for what reason, what reached the destination and what it answered. Events are hash-chained and the database refuses to modify them, so if someone tampers with one, the chain stops adding up. It is not a promise: it is something you can check.

Connect by pasting a URL

Ploybot speaks MCP, the protocol already used by Cursor, Claude Code, Claude Desktop, Codex, OpenCode and GitHub Copilot. Connecting an agent means pasting its MCP URL and signing in with your account: no tokens stored in files. From then on, the agent sees exactly the tools you assigned to it, and nothing else.

If you already have a documented API, you can import its OpenAPI, its WSDL or its gRPC definition: Ploybot proposes the operations and you choose which ones to publish.

In Europe, in your language

The service is hosted in the European Union, the console and emails are available in English and Spanish, and you can sign up, try it and subscribe without talking to anyone. If you leave, you export your configuration; secrets never leave.

Try it

The trial lasts 14 days and needs no card: enough to set up your first agent and see an approval end to end. After that, the Developer plan costs €49 and Team €199, taxes included, every 30 days.

You will find all the details at agents.ploybot.com, and the offer and terms in the console. If you would rather we show you, write to us through the contact form.