Agents inside the box
They read, edit, run and push in a workspace, under rules your organisation sets.
src/signup.tsautosrc/signup.ts, src/validate.tsautonpm testdeclared checkApproval · awaiting you
git commit -m "Validate signup input"Commands stop at an approval card. Approving resumes the turn.
Limit: the per-workspace proxy key is readable by that developer. It only works through your host.
Two ways in, one set of rules
The useful agent is the one allowed near the real repository. Kodela is how you allow it without handing over the repository or the keys.
Kodela runs AI coding agents in two ways, both inside the workspace: a chat built into the console, with five modes, and the agent CLIs your developers already use, Claude Code, Codex and Antigravity, installed and signed in through the host. Either way, the model keys stay on your host and anything leaving the workspace goes through it. On a member's own computer, if your organisation turns it on, the AI login still stays on the platform, but other internet access is observed, not enforced.
Agents on laptops use personal credentials with no shared rules. Vendor-hosted agents need the repository on the vendor's infrastructure. Model calls from Kodela go from your host directly to the provider, with your credentials. No Kodela service is in that path.
Five modes, gated tools
The chat runs a bounded tool loop in the console's backend. Each mode unlocks a set of tools. An unknown mode fails closed.
- Ask and Plan are read only.
- Commands and writes outside the project stop at an approval card. A parked write is shown as not written.
- A reply that claims a card it never drew is corrected.
Keys stay on the host
Your organisation connects its provider API keys once.
The platform holds each provider credential on the host, and the workspace never receives the real key. An organisation can hold several accounts, and grants providers per member.
Profiles decide how much the agent asks, not what it is able to reach. Reach is the egress and broker layer's job.
Defaults and limits
What a fresh install gets, and where each one stops.
| Capability | Default | Limit |
|---|---|---|
| Chat with five modes and approval cards | on; self-approval | "advisory" binding unless the organisation turns binding on |
| Agent profiles: supervised, assisted, autonomous | assisted | push and PR are off in every profile until enabled |
| Claude Code, Codex, Antigravity CLIs | installed | Antigravity does not yet use the host broker |
| Model providers: Anthropic, OpenAI-compatible, Gemini (chat) | per organisation | Codex and Antigravity are CLI-only |
| 68 platform skills; catalogue per organisation; skill picker | on | the skill picker has open bugs |
| Declared checks run without a card | empty allowlist | they run with no network |
| Skills from the repo, memory, MCP, subagents | off each | MCP servers must be on the organisation's allowlist; none are bundled |
Attachments in chat: images (PNG, JPEG, GIF, WebP), PDFs, text and code files (chat_images_enabled, chat_files_enabled) | on each | 5 MB per file; text cut at 100,000 characters; images and PDFs are not checked for secrets; PDFs refused while personal-data masking is on |
Personal-data masking in chat: emails, phone numbers, card numbers (ai_mask_personal_data) | off | chat only; an agent run in a workspace terminal is not covered |
| Agents run Docker commands, in a workspace with Docker on | on once Docker is on | only through that workspace's Docker broker; approval rules still apply |
| Token rate limits | unlimited | there are no currency budgets |
| Cost meter | off, no rates | measures only; it stops nothing |
| AI usage tab: requests, tokens and cost by member, workspace, surface, model and account | on for organisation admins and auditors | no spend cap; cost only where the cost meter is on; AI tools that hold their own login inside a workspace are not measured |
Platform know-how, built in
68 pinned, read-only platform skills teach agents your platform's rules: the broker, the gate, the scanners.
- Linked into every workspace for Claude Code, Codex and the chat.
- Organisations choose which catalogue skills to offer. Type
/in the composer to pick one. - Let the agent check its own work against the checks your project already declares.
- A turn outcome pill offers Continue when a connection drops. Images, PDFs and text files can be attached to a message; a text file carrying a credential is refused.
Two turns
Build mode
- "Add input validation to the signup handler."
- The agent reads, edits two files, runs the declared test check with no card, and proposes a commit.
- The developer approves.
Run/Debug
- The app fails to start. The agent reads the logs, edits the config and proposes a start.
- The card shows the exact command.
Questions
Which models?
Anthropic, OpenAI-compatible and Gemini, through your own API keys.
Does the agent see our API keys?
Not the real ones. The workspace holds a per-workspace proxy key that only works through your host.
Can it push?
Only if your organisation enables agent git and the member's profile allows it. Push is off by default.
Can it use MCP?
Yes, if your organisation turns MCP on and allowlists the server. It is off by default.
Can I attach a screenshot or a PDF?
Yes. Images, PDFs and text or code files up to 5 MB each; a text file is cut at 100,000 characters and the chat says so. An image goes to your organisation's Claude model with that one message and is not kept in the workspace. Images and PDFs cannot be checked for secrets, so a screenshot of a secret reaches the provider as it is. The audit records each file's name, type, size and fingerprint, never its content. An admin can turn either kind off.
Can the agent run Docker?
Only in a workspace where your organisation has turned Docker on. There, "Let the AI agents run Docker commands" is on by default, and the workspace owner or an admin can turn it off from the Docker card; each change is audited. Calls go through the same per-workspace broker with the same refusals, and your approval rules still apply. It never affects the person's own terminal.
Can we see what AI is costing us?
An AI usage tab for organisation admins and auditors: requests, tokens and cost by member, workspace, surface, model and account. There is no spend cap; cost shows only where the cost meter is on; AI tools that hold their own login inside a workspace are not measured.
Does Kodela send you any data?
No. The product has no telemetry. Model calls go from your host to your provider.
What it does not do yet
- A spend cap or budgets in currency. The AI usage tab measures; it stops nothing.
- Measuring AI tools that hold their own login inside a workspace.
- Checking images and PDFs for secrets. Typed text and text files are checked; a detection can miss an unrecognised shape.
- Masking personal data in a terminal agent run. Masking covers the chat only.
- Brokering for the Antigravity CLI.
- Copilot or Cursor.
- Web search for agents (planned; needs a search key your organisation provides).
- Governed background runs are built but gated per organisation.
Let the agent near the real repository
Without handing over the repository or the keys.