Install verified integrations. One click per tenant.

98 vendor-neutral interfaces

PaymentProvider, CRMProvider, CacheProvider, AIGatewayProvider, ObjectStorageProvider, and 90+ more. Every official implant implements one or more interfaces; community implants can claim the same interfaces and slot in.

Sandboxed execution

Every implant runs in a hardened sandbox with kernel-level isolation, dropped capabilities, validated source (no eval or dynamic require), and per-tenant module allowlists. The OS is the trust boundary; the validator is UX.

Scoping & approvals

install-preview lists every requested permission in plain language. Per-tenant grants. Approval workflow. OAuth credential cleanup on uninstall.

Webhook lifecycle

Lifecycle webhooks with HMAC-SHA256 signing, DLQ + replay, delivery logs, and per-endpoint health. Vendors know when something breaks.

Anti-gaming scheduler

Behavioral signals track install-count inflation, excessive permission requests, and revocation frequency. Misbehaving publishers get demoted.

Versioning & rollouts

Per-version rollout %. Rollback to previous version. Deprecation with sunset date + migration guide. Canary new versions on a single tenant first.

Vendor-neutral contracts

A single catalog of 98 platform interfaces across 26 categories. Action names follow a dotted <namespace>.<verb> convention so the marketplace stays searchable and vendors can ship multiple providers per interface.

• Categories include Payments, CRM, Storage, AI, Observability, Messaging, Productivity, Commerce
• Reserved names protect native platform surfaces (AgentProvider, MemoryProvider, SecretsProvider, BillingProvider, WorkflowProvider) from squatting
• Per-interface required + optional actions; community implants declare which interfaces they implement
• Renamed interfaces keep backward compatibility via an aliases column — junction FKs stay stable across renames

Signed, sandboxed packages

Official and community implants implement one or more interfaces. Each ships as a signed artifact with a per-tenant module allowlist, audited install/uninstall events, and version-pinned upgrades.

• Ed25519-signed artifact; install fails closed on signature mismatch
• Source validation blocks eval(), new Function(), dynamic imports, and prototype pollution
• Per-tenant module grants via dedicated allowlist files; default-deny set is immutable (child_process, vm, inspector)
• Anti-gaming cron runs independently of the feature flag — signals stay accurate even before launch

Action router with vault injection

At call time the dispatch layer resolves the tenant-scoped installation, decrypts vault credentials, and injects them as scoped env vars into the runtime. Plaintext never reaches the model context.

• Capability broker mediates secret use; secrets never leave the secret layer unencrypted
• Per-permission rate limits enforced before invocation; excess returns 429 with a typed error code
• Audit log captures SHA-256 of inputs and outputs per call — replay for incident review without leaking data
• Per-action input/output schemas validated at the router; reject payloads that do not match the declared shape

Author + sign

Build a .fci package (manifest + runtime + actions). Generate an Ed25519 signing key or reuse an existing one. Publish via the CLI or Studio.

Validate + certify

Platform runs the certification suite: mock tests, optional live tests against the vendor sandbox, schema validation, anti-gaming signal baseline. Status lands on the certification record.

Install per tenant

Tenants review install-preview (every requested permission in plain language), approve a subset, and the install rows are created. The first call resolves the tenant-scoped installation.

Dispatch + inject

The action router resolves the tenant installation, decrypts credentials through the vault seam, and injects them as scoped env vars into the runtime. The handler returns an envelope; the router logs SHA-256 of inputs and outputs.

Version + rollout

Publishers roll new versions out by percentage. Operators canary on a single tenant before promoting. Rollback restores the previous version in one call; sunset_date + migration_guide_url power deprecation.

Revoke + cleanup

Tenant uninstall removes per-tenant installation rows and triggers OAuth credential cleanup. Kill-switch revoke-all in the capability broker revokes any active secret grants in one transaction.

Stripe + crypto on-ramps

Stripe handles cards, subscriptions, refunds, and invoicing. crypto-pay-evm (Arbitrum, Base, Optimism) and crypto-pay-btc (BIP-84 native segwit) credit wallets atomically on-chain. Both implement PaymentProvider.

OpenAI + Anthropic + OSS providers

OpenAI and Anthropic cover the major proprietary models. OpenRouter, Minimax, and groq add fallback rungs. All implement ModelProvider so FlyAI can ladder-fail between them without code changes.

HubSpot, Notion, Slack, Google Workspace

Sync contacts and deals to HubSpot, capture knowledge to Notion, push notifications to Slack, read calendars and docs from Google Workspace. All implement their category interface.

Datadog, Sentry, PagerDuty, Linear

Emit metrics to Datadog, trace errors to Sentry, page on incidents via PagerDuty, file issues in Linear. Each implements the relevant provider interface and is scoped per tenant.

Redis, Postgres, S3, Cloudflare R2

Cache with the Redis implant, query Postgres directly, store blobs in S3 or Cloudflare R2. All implement their category interface; tenant configuration controls the connection string.

Discord, Twilio, SendGrid, YouTube, Zoom

Send notifications across channels. Discord for chat, Twilio for SMS and voice, SendGrid for email, YouTube for media metadata, Zoom for meetings. All implement the messaging provider interface.