declare · pack · submit

QuickAgent Builder

One agent, one job. Declare the least it needs — reviewers gate on the contract, installs prompt on it, and the runner enforces it.

Basics

Name the QuickAgent and say in one line what it does. Then choose how it runs.

NameSummary (one line, ≤140 chars)

Run modes (one or both)autonomous — runs from its files and endsinteractive — a chat session under the same controls

Opening line for interactive sessions (the agent's first message when no task is given; only with interactive checked)

Instructions

The instruction file (AGENT.md) tells the agent its one job. Say what it is given, the steps it takes and what it returns.

AGENT.md contents (up to 1 MiB)

Tools and web access

Say which sites the QuickAgent may reach and which MCP servers it uses, with the tools each may call. Everything is off until you list it.

Web accessDoes it need the internet?Sites it may reach (host names, when only the sites listed)

Any host (*) is refused by runners unless the operator's policy allows it, and routes the version to review by default.

A browser, for testing websites

A question of type site, in the Questions step, gives the run a headless browser that opens the site the person names, with its subdomains. List here any other hosts its pages load from, or let it open any public website.

Other hosts the browser may open (exact names, or *. and a domain) Any public website (routes the version to review, and runners refuse it unless the operator's policy allows it)

MCP servers from npm or PyPI (exact versions — pinned to this release and installed per-signature by the runner)

Sign-in, only if the server works with the person's own account (leave empty otherwise)

Remote MCP servers (run by their vendor, reached at an https:// address)

More servers (one per line: npm:pkg@1.2.3 tools=a,b secrets=X egress=host env=NAME=value, or https://host/mcp auth=oauth scopes=a,b tools=x)

A declared server reaches only the hosts listed for it; the runner refuses “*” for a server. A key a server needs is declared by name and never packed: whoever runs the QuickAgent supplies it, on their own machine or as a secret when they start it in Agentry. A remote server that signs in with a key sends it to its vendor as a bearer token. A server that signs in with OAuth asks whoever runs the QuickAgent to sign in at the vendor before its first run, and keeps that sign-in for this version alone; the run gets an access token and nothing else. A token file is packed with the QuickAgent and anyone can read it: where it needs a client id or secret, write a dummy such as “agentry”, and never a real token or secret.

Files, commands and data

Say what else the QuickAgent may touch. The least answer is already chosen.

Does it read files?Paths it reads (when only these paths)Does it write files?Paths it writes (when only these paths)Commands it runs (single words; empty: none)Keys or tokens of its own (NAMES of environment variables, never values)Keys a run cannot start without (NAMES, its own or its servers'; every other key is optional, and a run starts without it)Keys its browser may type into the site's sign-in forms (NAMES of its own keys; the browser types the value, and the agent never reads it)

Questions

Questions a run asks before it starts, in either mode. Ask only what the run cannot find out for itself.

The answers are staged read-only for the agent at /inputs/intake.json. A secret answer is carried by a declared secret of the same upper-cased name, and the question is required exactly when that key is. A host question asks for a server the run works over SSH ([user@]host[:port], up to four) and declares it under targetHosts: the agent can run any command there as the account the person signs in with, and only a run on their own computer reaches it. A site question asks for a website to test and gives the run a headless browser held to it (an http:// or https:// address, up to four), written as a url question under browser.sites.

Questions (up to three here; more in the line field below)

required

More questions (one per line: id: prompt type=choice choices=a,"b c" required; a choice with a space or a comma goes in double quotes)

Before a run

What a person sees before they start a run: what the QuickAgent does and what to gather first. It is shown to people only, never to the agent.

What it does and returns (markdown, up to 4 KB; empty: the run setup shows the summary)You will need (one item per line, up to ten)Files to bring (one line)Task hint (the task field's placeholder)

Help for each key it needs: where to create it and which scopes (markdown, up to 2,000 characters each)

More keys (one per line: NAME: where to create it, which scopes)

Knowledge

Knowledge packs the release carries in its archive, and what it asks a person to attach of their own. A shipped pack is scanned with the version and signed with it; the ask is shown to people only, never to the agent.

Ship with the release (up to 5)

Each pack goes into the archive under knowledge/<name>/ as it is kept in Agentry, unencrypted: anyone who can download the release can read it. A pack is at most 10 MiB, and a submission from this page at most 16 MiB compressed; publish a larger release from its tag instead.

Ask for a pack of the person's own (one line; empty: it asks for none) required: a run cannot start without one

Publishing

Where the QuickAgent is published and under which version and licence. Submit makes it public, which needs an SPDX licence.

NamespaceVersionLicense (SPDX)Tags (comma-separated, up to ten, optional)

Both pack agent.yaml + instructions + README + LICENSE — the same files either way.

What happens when you submit

Save packs the QuickAgent as an archive for your own machine. Run it there with agentry run --local, or agentry publish it later. Submit sends it to this registry's security pipeline. A version with only low or medium findings publishes, with every finding on its report, unless a policy holds it. A high finding, or content the scanner cannot read, sends it to a person for review. A critical finding rejects it. You are asked to confirm what it spends first.

You can build and download a QuickAgent without an account. Publishing needs one, because a submission has an author.

The contract as the form starts

network: egress none
filesystem: read workspace, write none
exec: none
secrets: none
dataAccess: none
modes: autonomous
visibility: public, on Submit

The least a QuickAgent can declare. What you change in the form is what the manifest carries: the scanner diffs it against what the instructions do, and the runner enforces it. The QuickAgent's page shows the contract after you submit.