Skip to content
Early access is open

Build agents that act.Embed them anywhere

MyDeepAgents is one platform to build AI agents and workflows, connect them to the systems you already use, and publish them into any website or product. Each tenant keeps its own data, keys and limits.

Start buildingSee how it works
Models
Claude by default, or bring your own
HIPAA
Claude on Amazon Bedrock, in its own cell
Keys
Yours, on AWS, GCP or Azure

Fig. 1A live agent run, as the console shows it

  1. TriggerA deal changes in HubSpot and the run starts.
  2. ReasonThe agent searches contacts and writes its answer.
  3. AskWrites wait for the deal owner. Here, that’s you.
  4. ActThe deal moves to Qualified, and the run is logged.

Works with

The models, systems and clouds you already use.

  • Models

    • Claude
    • Amazon Bedrock

  • CRM

    • HubSpot
    • Salesforce

  • Tools

    • Any MCP server
    • Any OpenAPI spec

  • Keys

    • AWS KMS
    • Google Cloud KMS
    • Azure Key Vault

  • Storage

    • Amazon S3
    • Google Cloud Storage
    • Azure Blob Storage

Why it exists

Anyone can demo an agent in an afternoon. Running one for real customers takes tenants, keys, approvals, budgets and an audit trail. MyDeepAgents gives you all of it, from the first agent.

01Platform

Everything an agent needs, in one place

Four building blocks share one definition format, one permission model and one audit log. Learn one and you know them all.

lead-qualifier.agent.json
{
  "name": "Lead qualifier",
  "profile": "privacy",
  "tools": [
    { "use": "crm.search_contacts" },
    { "use": "crm.update_deal", "approval": "always" },
    { "use": "docs.search" }
  ],
  "memory": { "scope": "end_user" },
  "limits": { "max_run_cost_usd": 0.50 }
}

Fig. 2An agent is a JSON document. The marked tool waits for a person to approve it.

  • Knowledge

    Upload documents or sync a source. Agents search it with hybrid keyword and vector search.

  • One model gateway

    Claude by default, Bedrock for HIPAA, or your own keys. Policy and metering apply to every call.

  • Usage you can see

    Every run, token and tool call is metered, with budgets that can stop a runaway agent.

02How it works

From definition to live widget in three steps

Agents and workflows are data, not code. That is what makes templates, staging and safe roll-outs simple.

  1. 1

    Define

    Describe the agent as data

    An agent is a versioned JSON document. It names slots for what it needs, such as a CRM, a knowledge base or another agent, and never a specific account.

    lead-qualifier.agent.json
    "slots": {
  "crm": { "kind": "connection" },
  "docs": { "kind": "knowledge_base" },
  "researcher": { "kind": "agent" }
}
  2. 2

    Bind

    Fill each slot, per environment

    Bindings connect each slot to a real connection for live and for staging. The same definition then works as a template for every client.

    SlotlivestagingcrmAcme HubSpotSandboxdocsPricingPricing draftresearcherResearcher v4Researcher v5
  3. 3

    Publish

    Publish an immutable version

    Publishing freezes the version and records its content hash. Every run notes the version it used, and one line of HTML puts it on any site.

    v12Published

    sha256:9f2c…a41e

    index.html
    <script async src="https://cdn.mdawidgets.com/w.js"
  data-key="mda_pub_…"></script>

03For partners and agencies

One tree for every client you serve

Tenants nest to any depth: partner, agency, client, business unit. Settings, limits and branding flow down the tree. Access never does. It is granted by delegation.

  • Settings show where they come from

    Every value names its source, so “Set by BrightMarketing, locked” is never a mystery.

  • Delegations instead of shared logins

    Scoped, time-limited, revocable and audited. A banner shows who is acting for whom.

  • Your brand on every client

    Branding is an inherited setting, so an agency’s look applies to all of its clients.

Pick a tenant to see what it inherits

Delegation · Builder · until 31 Mar

Clinic A · resolved settings

BrightMarketing can act here · Builder role · until 31 Mar

  • llm.allowed_providers=anthropicSet by BrightMarketing, locked
  • branding.theme.primary=#0E7C66Inherited from BrightMarketing
  • budget.monthly_usd=500Set here

Fig. 3Settings flow down the tree. Access needs a delegation, even for the parent.

04Compliance

Pick a compliance profile for each agent

Standard, Privacy or HIPAA. The policy engine enforces the profile at five choke points, so feature code never has to remember the rules.

Standard

For most products. Strong defaults, nothing in your way.

Model routing
Any provider you enable
Member sign-in
MFA optional
Run content
Encrypted at rest
Logs and traces
IDs and metadata only
Audit log
Kept 1 year
Widgets
Anonymous sessions allowed

05Security

A rigid core, so everything else can flex

One row belongs to one tenant. One transaction works in one tenant. Keys are per tenant. The flexible parts are safe because the core never bends.

clouds for your keys and storage
3
compliance profiles, per agent
3
policy choke points
5
immutable audit log under HIPAA
6 yrs
Your dataData keyTenant keyYour KMS · AWS · GCP · Azure

Try it. Everything inside the ring depends on this one key.

Fig. 4Envelope encryption. Each key is sealed by the one outside it.

  • Isolation the database enforces

    Every query runs in one tenant’s context, and row-level security checks it again. It fails closed.

  • Your keys, your cloud

    Bring your own keys and storage on AWS, GCP or Azure. Delete a tenant’s key and its data is gone.

  • Secrets never reach the model

    Credentials are decrypted only at the moment of the outbound call. Never in a prompt, never in the browser.

  • Untrusted code runs alone

    Custom code runs in an isolated Lambda sandbox with nothing to steal, never inside our workers.

  • Every outbound call is checked

    An egress proxy blocks internal addresses, pins DNS and allows only each connector’s hosts.

  • An audit trail for everything

    Who did what, as whom, and on whose behalf. Kept up to six years and immutable under HIPAA.

06Developers

API-first, all the way down

Everything in the console is in the REST API. Runs stream over server-sent events, webhooks are signed, and a tenant’s tools can be served over MCP.

  • REST and streaming

    One versioned API with stable error codes. Watch runs live over server-sent events.

  • Webhooks both ways

    Trigger workflows from any system, and receive signed events when runs finish.

  • MCP, in and out

    Agents call any MCP server, and your connectors can be served as MCP tools.

Start a run and stream it
$ curl -X POST https://api.mydeepagents.com/v1/agents/agt_4Fq9…/runs \
    -H "Authorization: Bearer mda_live_…" \
    -H "Idempotency-Key: 5c1e…" \
    -d '{"input": {"message": "Qualify the Acme lead"}, "target": "live"}'
→ 202 {"id": "run_8Kq2…", "status": "queued"}

$ curl -N https://api.mydeepagents.com/v1/runs/run_8Kq2…/events \
    -H "Authorization: Bearer mda_live_…"
event: run.started
event: tool.started       data: {"tool": "crm.search_contacts"}
event: message.delta      data: {"text": "Acme is a strong fit…"}
event: approval.requested data: {"tool": "crm.update_deal"}
event: run.completed      data: {"cost_usd": 0.04}

Fig. 5Start a run, then read its events as they happen.

Early access

Your first agent is a few minutes away

Build it, connect it, and put it in front of your customers. The platform handles the hard parts.

Start buildingExplore the platform