Connect any agent to everything.

Executor is a tool/source discovery and execution layer for agent-callable tools.

Executor doesn't care what you add. MCP, OpenAPI, GraphQL, custom sources, under the hood they all become a tool name, an input schema, and an output schema. Once they're in that shape, you can call them however you want. Today that's implemented as a code-mode MCP, but it could just as well be the Executor CLI, or a native client you drop in.

Because every tool looks the same, your agent can call them from gen-UI dashboards it writes on the fly, call them as one off scripts in a chat, or use them in reusable workflows.

Teams

Set your sources up once and your whole team has them. It supports per-user credentials and shared ones. No more onboarding ritual, no more toggling MCPs on and off mid-task. Your agents should be able to reach your company's resources in a way that isn't scary.

Sandboxing

Tool calls run in a JavaScript sandbox. The agent has access to secrets.

Destructive actions

Executor preserves the semantics of whatever it imported from: GET vs DELETE for OpenAPI, destructiveHint for MCP, mutations for GraphQL. That tells the agent what it can auto-run and what should pull you back into the loop, so it can work autonomously without taking you out of it.

It's all open source, built on the same SDK we publish to npm. There's two ways to try it, either the local version via the `executor` cli, or the cloud version.

— Rhys