Agents

Teach a local agent host Appaloft with appaloft setup agent. Workspace and Sandbox come later.

Short definition

The marketed Agent door is one command on this machine:

appaloft setup agent

It copies the Appaloft skill and writes token-free MCP into the hosts you already use. It does not deploy an app. Deploy stays appaloft up.

Workspace, Sandbox, and later preview surfaces are public alpha. They are not the start-page story.

flowchart TD
    SETUP["appaloft setup agent\nskill + MCP on this machine"] --> SKILL["Full Appaloft Skill\ncapability entrypoint"]
    SKILL --> DEPLOY["Agent Deploy Subprotocol\ncalls existing CLI/API/Web"]
    SKILL --> LATER["Workspace / Sandbox\nlater, public alpha"]
    DEPLOY --> OP["Shared business operations"]
    LATER --> OP

Why this group exists

When an AI agent operates Appaloft, it must follow exactly the same boundaries as a human user: it can’t bypass the application layer to operate the database, SSH, or a provider SDK directly, can’t read plaintext secrets, and can’t invent “agent-exclusive operations” that only it can call. This group collects the rules for “how an agent should use Appaloft safely” in one place, instead of repeating them scattered across every feature page.

Start with appaloft setup agent. Read Workspace and Sandbox pages only when you need those later surfaces.

Core concepts at a glance

Concept	One-line description	Detail
Appaloft Skill	The agent’s complete capability manual, mapped to the same operations as CLI/API/Web	Full Appaloft Skill
Deploy subprotocol	How an agent safely triggers a deployment	Agent Deploy Subprotocol
Agent Workspace	Later surface: long-lived collaboration on a Sandbox, currently public alpha	Agent Workspace
Sandbox	Later surface: isolated execution environment behind Workspace, currently public alpha	Sandbox Model
Task Run	Submitting, observing, and reviewing one agent execution on a Sandbox	Workspace Collaboration And Pause/Resume
Agent adapters	How to install and choose a specific agent runtime	Agent Adapters
Preview and promotion	Agent-driven preview deployment and production promotion flow	Agent Previews And Promotion
Delivery evidence	Verifiable evidence after a deployment completes	Delivery Evidence
MCP	The tool-calling protocol layer	MCP and tool protocols
Grok Bot plugin	Install `skills/appaloft` plus hosted MCP in Grok Bot	Grok Bot plugin

Common mistakes

Treating appaloft setup agent as a deploy: it only teaches local hosts. Deploy with appaloft up.
Treating agent deployment as a new business operation: agent deployment only translates “deploy this project” into existing project, server, environment, and resource operations — it never adds capabilities only an agent can call.
Letting an agent read .env, private keys, or token files directly: an agent should always work through the CLI/API/Web/MCP entrypoints — secrets should be injected through a trusted secret manager or environment variables, never read directly by the agent.
Assuming Appaloft uploads artifacts to a managed cloud: unless the user explicitly opts into Appaloft Cloud’s managed capability, the default deployment target is still the BYOS server the user chose themselves.
Starting on Workspace or Sandbox: those pages are later and public alpha, not the Agent door.

Advanced details

MCP (Model Context Protocol) is Appaloft’s protocol layer for tool-calling scenarios, sharing the same operation catalog as CLI/HTTP API/Web. Once MCP is configured, the Skill can use it as a callable tool layer; without it configured, the Skill still works normally through CLI/HTTP API/Web.