AGENTS

Agentic interaction. Deterministic infrastructure.

Coding agents are becoming a real interface to infrastructure. That is worth building for — and it is exactly why the infrastructure underneath must not become something nobody can read. Flui's position is that the conversation can be fluid as long as the resulting state is explicit.

What follows is implemented, not planned. Flui is not an autonomous cloud, and this page will never claim an agent runs your infrastructure for you.

01

The agent gets its own key. Never yours.

Your credential carries everything you carry, and once it is in a model’s context you cannot take it back out. An agent key is minted separately, shown once, stored only as a hash, and revoked on its own. Two lists decide its reach: what kind of work it may do, and which applications or projects it may touch.

02

One address, no session to hold open.

Flui speaks MCP at your installation’s API base with /mcp on the end. Every call is a POST with the key in an Authorization header. Nothing is opened, nothing kept alive, nothing to re-establish after a network blip — and clients built against older revisions of the protocol are served from the same tools.

03

On a write that matters, a person answers.

More than forty write routes do not run when the caller is an agent. The call is refused, and the refusal becomes a question addressed to a person: a request id, one plain sentence describing what was asked for, a link to where it is answered, and the fact that a price exists when it does.

04

The answer is once, always, or no.

Nothing holds a socket open while somebody thinks. The agent learns the answer by making the identical call again. A standing permission can be written down — and it can never widen what the person granting it was allowed to do in the first place.

Why the second half of the sentence matters.

An agent that can change your installation is a different proposition from one that can read it. The honest version of that proposition is not a longer list of permissions — it is a person, at the moment it matters, and a state you can still read afterwards.

The desired state stays in a file

An application is described by flui.yaml. It is what the CLI reads, what the dashboard writes, and what an agent changes — so a change made in a conversation lands somewhere you can read, review and revert.

A change an agent made looks like any other change

It diffs, it versions, it reproduces. There is no separate agent-shaped path into your infrastructure that behaves differently from the one a person uses.

What the agents did is on the record

Requests, decisions and standing permissions are visible in the dashboard rather than inferred from an application that changed shape overnight.

Connect an agent

Mint the credential, point the agent at the endpoint, and decide how far it reaches — without handing over your own key.

Read the task page

The action cycle

Why a write made by an agent stops and asks first, how it learns the answer, and why a standing permission can never widen what anyone may do.

Read the concept

Or connect one to a sandbox and watch it stop and ask. Try Flui for a day →