Guardrails
Hand it to an agent without holding your breath
An agent with a token can do anything that token can do, whenever it decides to. A Murmurator workflow is the same automation with its limits set in the product first — the connection it may use, the tools it may call, the branch it may take — and a record of everything it did afterwards.
The connection
A step reaches exactly one connection, scoped to the repositories or channels you listed when you added it.
The tools
Each step names the single tool it calls. Agent steps get the list you gave them and an iteration limit.
The workspace
Code is written in a sandbox that gets only the secret a command needs — a token to clone or push, a key for the agent's own model — pushes only where the connection allows, and is deleted with the run.
The branch
Conditions are values you can read in the definition, not a judgement the model makes at run time.
Connections
Scope it once, and every workflow inherits it
Access is configured on the connection, not repeated in each workflow. Add a GitHub connection with an allow-list of repositories and nothing built on it can reach anything else — not a workflow, not the assistant, not an agent on your MCP server.
- Allow-list repositories and channels per connection
- Database tools are read-only until you opt in to writes, which adds a separate tool
- Decide per connection whether its tools appear on the MCP server at all
Before it saves
A definition that doesn't hold up never lands
Every save is validated against your account: connections that exist, tools that exist, models you've added, cron that parses, JavaScript that compiles, and a step graph with no cycles. The assistant gets the same answer you would, so it fixes its own mistakes before you see them.
- Tool and model names are checked against what the account actually has
- JavaScript is compiled, and can be run against sample inputs first
- Dependencies are inferred from the steps you reference, and cycles are refused
Versions
Every change is a version, with a diff and a name
Nothing is edited in place. Each save records a one-line summary, the person behind it and where it came from — the assistant, MCP or the API — and keeps the full definition alongside a diff against the version before it.
- Compare any version with the one before it
- See whether a change came from a person, the assistant or an agent
- Runs are pinned to the version they started with, so history can't shift under them
Runs
Afterwards, the receipts
A run keeps what started it, and for each step the input, the output, the error, the logs and the tokens it spent. When someone asks what happened on the fourteenth, the answer is a link rather than an investigation.
- The trigger payload that started the run, kept with it
- Per-step input, output, error, logs and token counts
- Skipped steps show which condition skipped them
And the limits underneath
Ceilings you set, enforced by the engine
Configuration is only half of it. These hold whether the step was written by a person, by our assistant, or by one of your own agents over MCP.
Sandboxed code
JavaScript runs in a fresh V8 isolate per execution, with time and memory limits and no network, filesystem or module access. A workspace that writes code runs in a Docker sandbox with none of your credentials in it, deleted when the run ends.
Bounded agents
An agent step gets only the tools its definition lists and stops at an iteration limit — 10 by default, 50 at most.
A ceiling on spend
Built-in model usage is metered against a monthly limit an owner sets. Steps fail with a clear message rather than running up a bill.
Roles and scoped tokens
Owners and admins manage connections and models; only owners touch billing. An MCP token acts as one person in one account and is revocable instantly.
Works the same for agents
Your own agents get the same frame
Connect Claude, Cursor or an agent you wrote to the MCP server and it builds workflows through these exact controls — same validation, same versions, same role. The guardrails don't care who is typing.
Give your team the automation, and the brakes.
14-day free trial with $5 of built-in AI included. Cancel anytime.