Secure AI agents, inside your product.
The agent platform for SaaS and AI apps. Your functions become its tools, and each customer gets an isolated workspace with approvals, spending caps and receipts, built for production.
- 01Runs inside your app
- 02Calls your functions
- 03Asks before it acts
- 04Leaves a receipt
Everything an agent needs in production, already built
Calling a model is the easy part. Putting agents in front of real customers takes the harness around it. OpenLegion is that harness, kept current with the latest models, behind one API.
OpenLegionTool calling
defineToolFunction calling into your own code or MCP server, with a signed request that names the customer.
A workspace per customer
ws_Multi-tenant by design: agents, memory and receipts isolated for each of your customers.
Approvals
apr_Human in the loop: risky actions pause in your UI and resume when your user decides.
Spending caps
periodCreditsCredits reserved before each step, with a cap per customer that mirrors your plans.
A secrets vault
vlt_Keys stay outside the model. It only ever holds a handle.
Receipts and webhooks
evt_Every step on the record, and signed events to your backend.
Current models
model: "smart"Pick a tier per agent. We keep each tier on current models, so you don't chase releases.
Web search and fetch
trust: web_lowBuilt in, with everything they return labelled untrusted.
Pay for what runs
livemode: falseAn idle workspace uses no credits, and test mode moves no money.
You own the customer. We run the agent.
Three parties, and a clear line between them. Your product defines what the agent may do, OpenLegion runs it, and your customer only ever sees you.
Your product defines the agent as code
Its instructions, tools and limits live in your repo. The tools are your own functions, so the agent acts through the API you already trust.
OpenLegion runs one workspace per customer
Every action is checked against policy before it runs and leaves a receipt. Work stops for approval at three walls, and every credit is metered against the cap you set.
Your customer sees your brand, and only yours
No OpenLegion login, email or logo. We never contact your customers. Anything they should know reaches you as a webhook, and you decide what to tell them.
One template, an agent for every customer
A template is your agent product: instructions, tools, limits and a model tier. It's versioned like code, rolled out to every customer at once, and rolled back the same way.
Social publishing1
Posts planned and drafted for each brand; publishing stays with the brand
template: social-manager
- get_brandread
- list_videosread
- draft_postsdraft
+5 more of the product's tools
Email marketing platform
An agent that plans and drafts campaigns for each customer's audience
template: email-marketer
- get_audienceread
- draft_campaigndraft
- schedule_sendegress
Ads platform
A reviewer that watches spend and drafts changes to each account's campaigns
template: ads-manager
- get_spendread
- draft_changedraft
- apply_changewrite
Help desk
Triage for each customer's inbox, with replies drafted for a human to approve
template: support-desk
- list_ticketsread
- draft_replydraft
- send_replyegress
Ten minutes to an agent calling your code2
With the early-access kit: from nothing to an agent in your own app, in test mode, calling one of your functions. No MCP, tunnels or webhook signatures to learn first.
- 0–2 min
npx openlegion init
Signs you in, puts a test key in .env.local and writes three files: one route, your tools and your agent.
- 2–3 min
ol dev
Opens a tunnel to localhost, pushes your agent to test mode and tests the connection, including a mis-signed call that has to be refused.
- 3–5 min
Send a message
The reply streams into your UI and the agent calls your tool. The terminal prints every step, every tool call and what it cost.
- 5–10 min
Use a real function
Swap the example for a function from your codebase. It hot-reloads, and the next message uses it.
import { defineTool } from "@openlegion/platform";
import { z } from "zod";
import { db } from "@/lib/db";
// One of your functions, now one of the agent's tools.
export const draftCampaign = defineTool({
description: "Draft an email campaign for one audience",
input: z.object({ audienceId: z.string(), brief: z.string() }),
effect: "draft", // read · draft · write · egress
run: async ({ audienceId, brief }, ctx) =>
db.campaigns.createDraft(ctx.externalRef, audienceId, brief),
});import { defineAgent } from "@openlegion/platform";
import * as tools from "./tools";
export default defineAgent({
slug: "email-marketer",
instructions: "Plan and draft campaigns. Never send without approval.",
tools,
model: "smart",
limits: { periodCredits: 10_000 },
});import { AgentChat } from "@openlegion/platform/react";
// The agent, inside your product, signed in as your user.
export default function CampaignAssistant() {
return <AgentChat agent="email-marketer" />;
}Built to conventions you already trust
If you've integrated payments, you already know how this API behaves. The v1 contract is written to the same rules.3
Test and live modes
Separate keys, separate worlds. A test key can never touch a live workspace.
olp_test_… · olp_live_…Idempotency keys
Retry any POST safely.
Idempotency-Key: 4f1c…Signed webhooks
A timestamped HMAC with a five-minute tolerance, and secret rotation with overlap.
OpenLegion-Signature: t=…,v1=…Prefixed ids
Opaque strings you store and never parse.
ws_ agt_ run_ act_ apr_ evt_Dated versions
Pin a version; you choose when to upgrade.
api_version: 2026-12-01Request ids
On every response, and a doc link on every error.
Request-Id: req_…An events API
Thirty days of events to reconcile against.
GET /eventsSigned tool calls
Every call to your tools says which customer it's for, signed, so your code can check it.
verifyOpenLegionRequest(req)
Security the agent can't talk its way past
The model is never the final authority. Each control below is enforced by the platform, outside the model, the same way for every customer you serve.
Your user asks, inside your app
The receipt starts with who asked: your user, in that customer's own workspace.
Credits reserved before every step
Each customer has a cap that mirrors your plans. A reached cap refuses the run before it starts.
Every tool call checked by policy
Each call is an intent that one policy engine checks before it runs. The model is never the final authority.
Asks first at three walls
Reaching a third party, deleting data and acting on untrusted content wait for your user to approve.
Decided in your UI, recorded as theirs
Your customer approves inside your product, and the receipt names them as the one who decided.
Every step on the record
Your team sees the receipt in the console. Your backend gets the same facts as a signed webhook.
Every run leaves a receipt
- Signed with HMAC-SHA256 and a timestamp, and checked with one helper.
- Delivered at least once, with a stable event id to dedupe on.
- Thirty days of events by API, for when your receiver was down.
A kill switch that works mid-run
Suspend a workspace and its runs stop at the next step boundary, not at the end of the job.
POST /workspaces/{id}/suspend
Illustrative run
Spend that maps to your plans
Your org prepays one pool of credits. Each customer's workspace draws from it under the cap you set, and its usage feeds your own usage-based billing, so your margins hold whatever your customers ask for.
An idle workspace uses no credits.
Org pool · prepaid
250,000 credits
- ws_8f2KqL3xT9 cust_bluebird-bakery6,679 / 10,000
- ws_1Zd9Hw4pQe cust_northwindCapped
- ws_6Hn2Vb8sLm cust_lumen-labs3,180 / 25,000
+5,000 Credit grant: a top-up for one customer, spent after their monthly allowance
- ws_4Tp7Rc1xKa cust_old-coArchived
unused credits return to the pool
Questions builders ask
What is OpenLegion?
A platform for SaaS companies to put AI agents inside their own product. You define the agent and its tools as code; OpenLegion runs one workspace per customer, with policy checks, approvals, receipts and per-customer caps.
What's the easiest way to add AI agents to my app?
Use a hosted agent harness instead of building one. With OpenLegion you define the agent and its tools as code, create a workspace for each customer with one API call, and put the chat in your own UI. Tool calling, approvals, spending caps, isolation and receipts are already handled.
How does OpenLegion keep AI agents secure in production?
Security is enforced by the platform, outside the model. Each customer's agents, memory and receipts are isolated in their own workspace. Every tool call is checked against policy before it runs, keys stay in a vault the model never sees, and untrusted content can't trigger a send, a delete or a change without approval. Every step leaves a receipt. The security page lists what we enforce and what we don't claim.
How long does an integration take?
The kit's target is ten minutes to an agent calling one of your own functions in your app, in test mode. About an hour gets you your real tools and webhooks, and under a day gets you live.
Do my customers sign up with OpenLegion?
No. Your backend creates a workspace for each customer with one API call. Your users never see an OpenLegion login, email or logo.
Will OpenLegion ever contact my customers?
No. It's a hard rule in the platform: no emails, messages or notifications to your customers. Anything they should know reaches you as a webhook, and you decide what to tell them.
How do the agent's tools reach my product?
Tools are your own functions, defined with the kit, or your own MCP server. Every call is signed and names the customer it's for, so your code can check it before doing anything.
What integrations does OpenLegion support?
Your agent's tools are your own functions, defined with the kit, or your own MCP server, so it can work with anything your product already connects to. Web search and page fetching are built in, and results reach your backend as signed webhooks.
Where does work stop for approval?
At three walls only: reaching a third party, deleting data, and acting on untrusted content. Your customer approves in your UI and the decision is recorded as theirs.
How is usage billed?
In credits. Your org prepays one pool, and each customer's workspace draws from it under the caps you set. Partner pricing is shared with early-access partners.
Is OpenLegion affordable for a small team?
You pay only for what runs. An idle workspace uses no credits, test mode moves no money, and per-customer caps stop runaway spend before it happens. Partner pricing is shared with early-access partners.
Is there a test mode?
Yes. Test and live are separate worlds inside one org, with separate keys. Test mode runs real models on a monthly test allowance, and a scripted model for deterministic CI.
Which models do agents use?
A template picks a model tier rather than a model id. We keep each tier on current models, so your agents move to newer models without you tracking releases, and you choose the trade between quality and cost per agent product.
Do you have SOC 2 or ISO 27001?
Not yet, and we don't claim them. The security page lists what the platform enforces today and what we don't claim.
Is OpenLegion available now?
It's in private beta. We're onboarding a small number of partners; request early access and we'll be in touch.
What is OpenLegion?
OpenLegion is a hosted agent harness for running secure AI agents in production inside SaaS products and AI apps. A developer defines the agent and its tools as code. OpenLegion runs one isolated workspace per end customer, checks every tool call against policy, keeps a receipt for each action, stops for approval at three walls, meters usage against per-customer credit caps, and keeps each model tier on current models. Integration is an HTTP API and signed webhooks, with a TypeScript kit in development.
Give every customer an agent of their own
We're onboarding a small number of SaaS partners in private beta. Tell us what your customers need an agent for, and we'll get you set up.
Notes
Social publishing is our own product and our first partner. The other three templates are illustrative.
The kit is in private beta and ships with early access. Ten minutes is the bar we hold it to, and the code shown previews its API, so names may change before release.
The API is in private beta. Partners get the full reference with access.