PH热榜 | 2026-07-09

@tessa_lynch Tessa, you nailed the exact insight the whole company is built on. The demo is the easy 10%, everything after is where projects go to die.

And it's actually more than production-grade workflows. The full picture:

Native tools across the stack, so you're not maintaining a zoo of integrations. Proprietary infrastructure on AWS with one-click deployments, no DevOps ceremony between you and production. Compliance built in from day one: ISO 27001, SOC 2 Type II, NIS2, because for enterprise that's not a nice-to-have, it's the entry ticket.

And the part that ties it together: you can create all of it in natural language.

Workflows, agents, interfaces, deployments. Describe what you need and Composer builds it on that same production-grade foundation, so "prototype" and "production" stop being two different projects.

@tessa_lynch I Loved the direction here. The biggest takeaway for us is that Timbal isn't just helping people build AI agents, it's helping them ship AI agents confidently.

We're also getting ready to launch Juno AI, a personal AI assistant focused on making everyday workflows simpler, so it's always inspiring to see fellow builders tackling different parts of the AI ecosystem.

We'd genuinely love to hear your thoughts once we launch as well. Wishing the entire team an amazing Product Hunt launch! 🙌

@vincentbanzpk4 Exactly what we're tackling, Vincent. Retrofitting monitoring after shipping is where most AI projects stall, so we made it a property of the runtime instead of an afterthought.

Context on why: we're enterprise-focused, and that market doesn't forgive missing observability or governance. The nice side effect is that SMEs and agencies get the same performance and security machinery out of the box, stuff they'd normally never have the resources to assemble. The reliability layer is a byproduct of building for the hardest customers first.

@hassan_ismail_rebe Less context switching, more building. That's the whole thesis, glad it lands.

Composer is the piece that makes it real: think n8n + Lovable + Supabase, but as one proprietary stack. Nothing is wrapped, workflows, interfaces, and the database all run on the same core, and you build all of it in natural language without leaving the platform.

Also worth knowing: it's model agnostic. 120+ models supported, with native image and video generation built in. One stack, but zero lock-in on the model side.

@alheri_murya Fair challenge, Alheri. Two parts to the answer.

First, Timbal isn't an agent project sitting on top of someone else's stack. It's a full suite built on our own proprietary Python framework, where orchestration, evals, observability, and the data layer are all native to the same runtime. That matters because the failure modes of agents in production usually live between tools, and we don't have a between.

A concrete example. For a client automating public tender analysis, we run a workflow that calls different specialized agent nodes: one extracts requirements from the tender docs, one checks them against the client's catalog, one drafts the response. Each node runs with ACE (our Action Control Engine) turned on, which enforces the expected behavior of every step. If a node's output doesn't pass, the runtime retries automatically, and if the primary model keeps failing it falls back to a secondary model, all without a human touching it. And when a step genuinely needs a human, you configure human-in-the-loop directly at the framework level: the workflow pauses, routes to a person for review or approval, and resumes with their input. Every retry, fallback, and decision is traced, so when something looks off we can see exactly which step and why.

In most stacks all of that resilience logic is glue code you write and maintain yourself. Here it's just how the runtime works. Happy to go deeper on any piece of it.

@sarahjadefi Really appreciate you naming that Sarah, because it's a distinction we care about a lot. Simple shouldn't mean hidden, it should mean you're not fighting the tool to see what's actually happening.

That's why everything runs with full observability and evals from day one, not something you bolt on once things start breaking. As a project scales, that visibility is usually the difference between "we caught the issue in staging" and "we found out from an angry user."

@amanda_silmon That's the exact reason this whole thing exists, Amanda!

We got tired of watching people spend more time configuring tools than actually building the thing they cared about.

Since you're here and clearly get it, we're giving away 40,000 free credits right now for anyone who wants to put Timbal through a real project. Would love to see what you'd build with it 🙌

@georgiafor9p Georgia, that's the whole bet we're making. Every "just add one more tool" decision feels small in the moment, but a year in, most teams are maintaining a stack nobody fully understands anymore, including the people who built it.

Timbal replaces the orchestration layer, the data layer, the UI layer, and observability in one runtime. Not five vendors talking to each other through glue code, one system that already knows about all the pieces.

@georgiafor9p Indeed! And this is one of the main bets we are making. Most teams end up with a vector DB, an orchestration framework, a UI tool, and an observability layer, all coming from separate vendors and having their own quirks, so it involves a lot of work to glue them together instead of building the actual product.

With Timbal, knowledge bases and retrieval run on our own hybrid DB engine instead of a separate vector DB, the UI builder is native, and observability and evaluations are part of the runtime instead of a dashboard. This means that Timbal allows you to have the four or five tools you'd normally stitch together but already in the same place and seamlessly talking to each other.

@anthonywrinqsb Yeah, this is one we see constantly. The AI part rarely breaks first, it's the coordination layer around it. One person tweaks a prompt, someone else changes the data schema, and two days later nobody can explain why the agent's behavior shifted.

We actually live this ourselves internally, we're selective about the AI projects we take on, each one led by a small, focused team, but we help each other across projects constantly. Having workflows and traces live as an actual git repo (commits, diffs, branches) helps a lot here, everyone sees exactly what changed and when, instead of "it worked yesterday" being the only explanation you've got.

Hello@anthonywrinqsb 

I'd love to collaborate with you. Could you help me with my business?
https://docs.google.com/document/d/13GmfwDnnIpzLbKF7nGpsYmm9XM8AbDSfWIhBI3OG9PM/edit?tab=t.0

@pablo_martin6 Yes! Very glad that this part jumped out, because it is exactly one of the reasons why we built human-in-the-loop the way we did. The problem of "Who approved this" used to blow up procurement conversations late in the process, while now it's just logged at the step level, so it's a much quicker turnaround!

@pablo_martin6 Thanks Pablo, love getting a sales-side perspective on this one 🙌

@marti_norberto  @aduma__emmanuel That's the part that took us the longest to get right, and honestly the part most builders underestimate until they're already in production and things start breaking in ways they can't trace.

Getting an agent to work is the easy 10%. The other 90% is retrieval, observability, evals, permissions, all the stuff that never shows up in a demo but decides whether you can actually trust the thing with real users. That's the whole reason Timbal exists.

@advin_jadis Great question, and honestly the guided import you're describing pretty much exists, it's called Composer. Two ways to migrate today: 1. Send your code or workflow directly to Composer, our super agent. It can translate workflows from Make, n8n, and other providers straight into Timbal, so you're not rebuilding node by node. 2. Connect your GitHub repo and let Composer manage the migration from there: it reads your existing project and brings it into the Timbal stack. Either way you end up with a native Timbal workflow, with the eval and observability layer on top from day one, not a wrapper around your old setup. If you have a specific project in mind (a Make scenario, an n8n flow, a repo), try throwing it at Composer and tell us where it struggles. That feedback is gold for us right now.

@mathew_chang Thank you your support, Mathew! We are very proud that we manage to tackle the whole lifecyle, we believe it is a big step forward!

@andrasczeizel Appreciate you saying that, means a lot given how much of the last two years went into exactly that side of it.

To your question: honestly, both, but for different reasons. Internal workflows tend to be the fastest wins, teams automating things like tender analysis, data cleanup, or ops tasks that used to eat a huge amount of manual hours. That's usually where clients start because the risk is lower and the ROI is immediate.

Customer-facing is where the governance and observability layer really earns its keep, once an agent is talking to your actual users, "it worked in testing" isn't good enough anymore. You need to know exactly why it made a decision, and you need guardrails that hold even when the input is messy. We've got clients running both today, but if I had to generalize, most start internal and move customer-facing once they trust the reliability layer.

@gaspard_dupuich Thanks Gaspard! Short answer: whatever level they want.

Think of it as a Lovable inside Timbal. You can keep iterating with Composer in natural language until the interface is exactly what you had in mind, and if you want to go deeper you can download the code or connect your GitHub and work on it directly. It's real code you own, not a locked template, so there's no ceiling where the builder stops and you're stuck.

On templates: we already ship with them. They're not exposed as a gallery in the platform yet (coming soon), but Composer already fetches them from the backend and picks the ones that match the intent of your prompt. So in practice you're rarely starting from a blank canvas, even if you never see the template library itself.

Curious what kind of interface you'd build first, that helps us prioritize which templates to surface.

@kelly_king3 Kelly, that's exactly the framing we'd hoped someone in an operations seat would catch. Tool sprawl doesn't show up as one big line item, it hides in five smaller subscriptions, the engineering hours spent gluing them together, and the incident that takes twice as long to debug because the trace lives across three different dashboards. It's a real cost, just a quiet one.

Really glad this is going on your evaluation list. If it'd help to skip straight to the parts most relevant to how you'd actually use it, happy to set up time rather than have you piece it together from launch day comments.

Congrats on everything you're building at Creatium too, always good company on PH launch day.

@kelly_king3 I love that framing, "quiet cost" is exactly right. Excited to see where your evaluation lands 🙌

@startup_guy Hello! You can jump in directly at timbal.ai

@galdayan The pitch isn't "you'll never need to rip anything out," it's that ripping something out doesn't leave you stuck.

Everything in Timbal, agents, workflows, integrations, compiles down to clean, readable code you own. Nothing is a black box abstraction that only makes sense inside our platform. So if a team outgrows the UI builder, or needs a more specialized eval setup than what we ship, you're not migrating off a proprietary format, you're working with code you can already read, edit, run locally, or self-host.

In practice, most teams don't rip pieces out entirely, they go deeper into code for the specific piece that needs more control while keeping the rest running natively (same pattern Gaspard asked about for interfaces earlier in this thread)

@ilko_kacharov Hey Ilko! The alternative most teams end up building is logs scattered across five different tools, and by the time something breaks you're reconstructing what happened from fragments. Baking tracing into the runtime means every step, model calls, tool calls, retries, fallbacks, is already captured as it happens. You're not debugging from memory, you're replaying the exact decision chain.

@ilko_kacharov Also just checked out Juma AI, the marketing focus is really interesting, that's actually my world day to day. Would love to compare notes sometime 🙌

@edith__christian Edith, exactly the pattern we kept running into with our own clients before building this.

Every new AI initiative meant another subscription, another auth flow, another thing to monitor separately.

Happy to get specific if it helps. What's currently in your stack that you'd want to see replaced first? That tells us a lot about where the pain is actually concentrated.

@eoin_bishop Great question Eoin, this is exactly the layer where most agent projects fall over.

Evals in Timbal work at two levels. First, natively in the Python framework: you define evals per step or across the whole workflow, so in a multi-step agent system you can pinpoint exactly which node degrades instead of just seeing "the answer got worse." Second, Composer can create those evals for you and wire in ACE (our Action Control Engine) to enforce the expected behavior of each step, so evals aren't just a report you read after the fact, they become constraints the runtime actually holds.

All of this runs in a parallel or pre-deployment environment, so you validate reliability before anything touches production. That's the enterprise-ready part: you're not testing on your users.

On sample reports, fair ask. Attaching a real one below: cost and latency comparison of the same task with ACE on vs. off. Latency 5.17s vs 12.21s, cost $0.007 vs $0.089, one tool call instead of many. Enforced behavior isn't just safer, it's dramatically cheaper and faster because the agent stops wandering.

@miguel_jalon Yes! ACE works with standard OpenAI chat completions out of the box. The behavior enforcement sits at the runtime level, so it's provider-agnostic: OpenAI, Anthropic, open models, whatever you're running.

And here's the part most people miss: ACE is actually a standalone product. You don't need to be building inside Timbal to use it. You can drop it into your own agents and workflows, on your existing stack, and get the same behavior enforcement layer. Integration is genuinely a few lines.

So if switching models isn't trivial for you today, good news: you don't have to switch anything. Bring ACE to the stack you already have.

@miguel_jalon Thank you for your support Miguel!

@carla_granados_soler Thank you so much for this, and for putting Timbal through its paces on the daily 🙌

Great question. ACE isn't one global switch, it's set per step/agent, so you can tighten it where you want strict guardrails (approvals, writes, anything customer facing) and loosen it where you actually want the model to explore, like open ended research or ambiguous classification.

The mechanism is the easy part honestly, the harder part is knowing where to draw that line for a given use case, we're still learning from real usage what the right defaults should be.

Have you hit a specific case where it felt too rigid? Would love to dig into it with you.

@maria_wall_ball Thanks!! Means a lot coming from someone building in this space too!

@yernururu Thanks, glad the agent held up! Fair question, and actually it tends to go the other way. ACE stops agents from wandering into extra tool calls, so token usage often drops instead of climbing, and overall ends up more economical 🙂

@marc_matas Yeah exactly, this is precisely the split we think about a lot internally. Composer is the fun part people notice first, but production is where it actually gets hard. After a bit, "worked in testing" is just not good enough anymore. That's why tracing, evals, and governance are built in from the start instead of something you bolt on after it breaks once. Thanks for your support!!

@nayan_joshi Thanks Nayan! The gluing is always the hidden cost, nobody budgets three weeks for "make orchestration, logging, and UI talk to each other" but everyone ends up paying it.

That's exactly the tax we built Timbal to remove. One runtime, so nothing needs to be wired together after the fact.

@gnepalanclx6es Good question, Güneş. Timbal is pay-per-use, so it scales with actual consumption rather than seat count or a fixed agent limit. You're not paying more just because you added a team member or spun up another agent, you pay for what actually runs.

On top of that, you set well-defined budgets, so heavier eval runs on bigger workloads don't turn into a surprise invoice. You know your ceiling going in, whether you're a small team experimenting casually or an enterprise running production workloads at scale. Predictability was a deliberate design goal, not an afterthought.

If you have a rough sense of your expected volume (agents, workload size, eval frequency), happy to help you sanity-check what that would look like in practice.

@ridhwikvinod On your specific pain point, rollback. Every workflow is a real git repo, commits, diffs, branches. A bad prompt change is just a commit you revert, same as reverting any other code change, no separate rollback UI to figure out under pressure.

On testing before production:,you define evals per step, so you're not just checking "did the final output get worse," you can pinpoint which exact node degraded. Composer can also scaffold a starting eval set for you if writing them from scratch isn't where you want to spend time.

For a 40-person team running this internally without a big platform team behind it, that combination (git-native rollback + step-level evals) is probably what saves you the most time day to day, not because either piece is fancy, but because you already know how to use them.

@zxy_action1 One thing we really liked about Auriko is that you didn't stop at offering a unified LLM API, you focused on intelligent routing, cache-aware optimization, and cost-efficient inference. That's the kind of infrastructure that becomes increasingly valuable as AI applications move from prototypes to production.

We're building Juno AI, a personal AI assistant, and we're preparing for our launch soon. As we've been thinking about reliability, latency, and balancing different models for different tasks, it's been fascinating to see products like Auriko tackling those challenges from the infrastructure side.

We'd genuinely love to get your thoughts on Juno once we're live. Congrats on an impressive launch, and wishing the team all the best!

@ridhwikvinod lol looks like you are a pro on OTC trading! Don't worry about the performance - the cost is optimized without compromising the quality of models!

@ridhwikvinod Great question, and we agree. Cost savings are only useful if quality stays predictable.

Quality control starts with explicit model constraints. In Auriko, the model catalog uses truthful model identities, and users can specify the exact model they want, including quantization where relevant. Routing then stays within those boundaries. We also evaluate models before adding them to the Auriko catalog.

Optimization is about choosing the best provider/path for a model. Under the hood, Auriko computes a composite routing score using live signals that represent expected cost, TTFT, latency, throughput, and reliability. You can use the default strategy, choose different strategies for different workflows (we recommend using different api keys for different workflows to maximize our calibration engine's and improve your cost savings), or specify your own routing weights. For example, if throughput matters most for a use case, you can increase the throughput weight.

@longway1 Thanks for the question Kevin! Our data engine actively tracks model performance - latency, throughput, reliability, etc. The routing engine computes a composite score for each available route.

Users can choose preset routing strategies depending on what matters most for a workflow, like cost, TTFT, or throughput. Power users can also set custom routing weights for more fine-grained control.

@crystalmei Great question! Definitely pre-request.

When a request hits Auriko, we build the available routing candidate set, apply hard constraints like capabilities, budget, data policy, parameter support, and availability. The routing engine scores every available candidate i across cost, latency, throughput, and success rate, then picks the best one based on your strategy

The request performance data feeds back into routing: we use it to generate provider health and performance signals, then use those signals to calibrate future routing decisions. So the main value is real-time routing, with observability data used to make the router smarter over time.

@shubham4real Love this question! Auriko handles the provider side automatically, but we still recommend following prompt-caching best practices since we do not see or log user's prompt (we have a Zero-Data-Retention policy!)

When you route through Auriko, we account for each provider’s caching behavior before sending the request: whether the model supports caching, how cache pricing works, and which route is likely to be cheaper for that workload. For supported providers, Auriko can also apply the right cache hints automatically, like Anthropic cache_control, OpenAI prompt_cache_key / retention, or session affinity where that helps reuse. We also normalize cached-token and savings reporting in the response. The part we still recommend users do is keep reusable context stable: system prompts, tool schemas, few-shot examples, long instructions, repeated RAG blocks, etc.

@galdayan Yes! The router accounts for cache state. We also calibrate routing against each user’s usage pattern. For example, if you are a heavy coding-agent user with rapid-fire requests, large context, and long conversation sessions, that pattern becomes an input signal to the routing engine. In that case, Auriko may prefer a provider with deeper cache discount instead of chasing a cheaper provider on headline token price.

@yolo_xiao Exactly. Caching is easy to know about but hard to price correctly, because every provider handles prompt caching differently, and cost is also a function of the user’s request pattern.

If we had a crystal ball and knew the exact content and timing of a user’s future requests, as well as each provider’s exact caching mechanism, we could compute the cost of the same workload across providers and pick the cheapest path. In reality, the problem is much harder because the information is incomplete. The user’s request pattern has to be estimated, and each provider’s prompt caching mechanism has to be probed and modeled correctly. That is where Auriko’s quant-trading-inspired infrastructure comes in, and how we are able to drive around 30% cost reduction.

@yolo_xiao Caching is exactly one of the most important factor in model routing - nice catch!

@lakeesha_weatherwax Definitely! Power users can fine-tune the routing strategy to their specific objective.

@shawn_idrees Yes the mission of Auriko is to free you up from the tedious work of choosing models!

@boyuan_deng1 Yes if you are using another model aggregator or router, you will mostly likely see the cost reduction against it! It should be self-explanatory with some A/B test. Happy to help you set up a test to see the difference!

@abod_rehman Definitely. There are two ways to control this in Auriko.

1. you can set hard constraints, such as a TTFT ceiling. 2. you can use softer control by increasing the weight of response time (TTFT) in the composite routing score. Both affect the routing decision!

@anthony_cai Thank you for the support! give it a try!

@irahimiam Very sharp question! In a nutshell, we model expected cost across the full session, not just the first request.

For example, a heavy coding-agent user with rapid-fire requests, large context, and long sessions will usually have a very different cache-hit profile from someone running periodic deep research. Auriko calibrates routing against each user’s usage pattern, and that pattern becomes an input to the expected cost computation. So in some cases, our routing engine may choose a provider with a deeper cache discount instead of choosing a provider with the lowest headline token price.

@phoenixhu We measure metadata such as latency, throughput, error rate, fallback, cache-hit and use that to inform our routing engine. And user can check all information in detailed request logs

@thys_beesman  Thanks and great question! It's both.

The routing engine decides where the llm request should go before it is sent. For each request, Auriko builds the eligible provider set, applies hard constraints like capabilities, data policy, budget rules, parameter support, and availability, then scores the viable routes accounting for expected cost, latency, throughput, capacity headroom, and cache economics. The cost model accounts for provider-specific prompt caching mechanics and the workload’s reuse patterns, so routing is based on expected request-level economics, not just static model prices.

We then feed the request metadata back into our signal generation engine for future routing decisions. This helps us maintain a dynamic and effective awareness of the routing candidates.

@nicole_h94 Thanks for the feedback! We have detailed log and audit trial for all llm request and all management api key. The goal is to provider enterprise grade control and observability.

@omri_ben_shoham1 Very valid concern, and we are very aware of this concern. Cost optimization only works if quality stays predictable.

We gate the Auriko model catalog and make sure each model is represented truthfully, including quantization. Instead of optimizing for wide inference provider coverage, Auriko optimize for inference provider's quality and credibility. Users can specify the exact model they want, and optimization does not mean quietly swapping to a lower-quality variant. We also evaluate models before adding them to the catalog.

Optimization is about choosing the best provider/path for that model. Under the hood, Auriko computes a composite routing score from live signals across expected cost, TTFT, latency, throughput, and reliability. You can use the default strategy, choose different strategies for different workflows, or specify your own routing weights. We also recommend using separate API keys for different workflows, so our calibration engine can learn each traffic pattern more cleanly and improve cost savings. For example, if throughput matters most for a use case, you can increase the throughput weight.

@withshawn Thanks for the comment! Our data engine tracks and tests provider-specific behavior like token thresholds, block granularity, read/ write pricing, expiration windows, and pricing tiers.

Auriko also handles the provider-specific steps needed to activate caching where possible, like cache directives, cache keys, or session affinity. Developers still see a normal OpenAI-compatible API and consistent cache usage/saving fields in the response.

@ece9cgh Thanks for the support! Yes! quant trading and model routing share similar magic - arbitrage and optimize!

@fanny_guillou Exactly - trading and routing, this is the way how you maximize your token usage!

@krekeltronics Definitely - audit trail just assures you everything is transparent!

@moon10 Thanks!

@yuki1028 Thanks!

@tammytan516 Thank you for the support!

@grey_seymour Glad you like it!

@qutub_syed Many congratulations Qutub, Intesar and team on the launch! :)

How I met the maker: I met Qutub a few weeks ago when he pitched me the product. We had a few back-and-forth conversations on the messaging and assets before the launch was ready to go live, and I really enjoyed brainstorming and discussing it with him.

What is the product?

Perfai Security is an autonomous security platform for vibe-coded apps. It finds and fixes live access-control vulnerabilities in apps built with tools like Replit, Lovable, Claude Code, Cursor, and other AI coding platforms.

Why I endorse it?

I endorse it because it tackles a real problem for modern builders: shipping fast often means shipping blind on security. Perfai makes it much easier to catch and fix vulnerabilities before they reach users, without needing a security expert on hand.

Enter your vibe-coded app's URL and find vulnerabilities in minutes: https://perfai.ai/

@qutub_syed @intesar_mohammed1 Great launch. AI makes apps easy to build, but permission mistakes cause most data‑privacy leaks. Even small apps have thousands of access checks.

Perfai Security helps builders — and bug‑bounty hunters — find these issues fast.

@qutub_syed Congratulations Intesar and the team on the launch!

I met Intesar and the team at AI DevSummit 2026 a couple months ago. We are a stealth startup that hadn't done any formal security testing, and Intesar offered to help. That conversation turned into a real engagement.

Perfai is an autonomous security platform that finds and fixes live vulnerabilities in AI-built apps. It maps your full attack surface: UI workflows, API endpoints, token security, privacy compliance, and runs hundreds of tests simultaneously across OWASP and its own AI-native framework, and tells you exactly what to fix.

Why I endorse it: Because it delivered real findings, fast. Across two test runs on our platform, Perfai executed 258 automated tests(240 security tests across 7 API endpoints and 11 UI workflows, plus 18 privacy tests) and surfaced 6 high-severity issues we didn't know about: 2 security vulnerabilities (missing RBAC and rate limiting) and 4 privacy compliance gaps (missing GDPR user rights endpoints). What impressed me most was the follow-through. Intesar and the team facilitated multiple reruns as we addressed each finding, confirming fixes were holding before marking them resolved. We have not tried the fix agent yet. That is next on our list. If you're building and haven't done a security pass yet, this is the fastest way to find out what you're missing.

@tarkb3lu Thanks for sharing that.. an exposed API key and an open redirect are exactly the kind of issues that can slip through when you're shipping quickly with AI. It's usually not carelessness, just not having time to inspect every endpoint and flow.

Glad Perfai caught them in one pass. If you've got a larger app with multiple roles and real user data, that's where it starts finding the more interesting access control issues too. Give it a run and see what it turns up.

Thanks again for sharing the results!

@tarkb3lu This is awesome to hear! Thanks for sharing.

An exposed API key and a sketchy redirect are exactly the kind of bugs that slip through when you ship fast. Glad the fix flow made it easy too. That's the goal: find it, fix it, move on.

And don't feel bad about the earlier app. Almost every vibe-coded app we test has issues like this. You're ahead of the game now.

If you want to scan more apps, the free tier is there, and we're giving away 50% discount codes for the launch. Every scan comes with a full pentest-style report. Need extra credits or help onboarding another app? Just reach out. Happy to help!

@anand_thakkar1 that's exactly the right question, and yes 🔥. It's one of the biggest reasons we built the Vision Agent. Instead of looking at isolated endpoints, it learns how your app actually works by mapping the workflows and request sequences it uses, like create → update → approve → read

The Security Agent then replays those flows and mutates them to uncover things like multi step privilege escalation, state transition abuse, creating an object as role A and accessing it as role B, or skipping an approval step a few calls earlier. These are the kinds of stateful authorization issues that only show up across a sequence of requests, so most scanners never see them.

Every finding comes with the exact request chain needed to reproduce it. Business logic chaining is an area we're continuing to push hard on.

Give it a try and see what sequences it surfaces in your app. It's free: perfai.ai

@anand_thakkar1 Great question! This is exactly why we test live apps instead of just code. Some auth bugs only show up when requests happen in a certain order, and code scanners can't see that.

Yes, we handle multi-step exploits. Our Security Agent learns how your app works, then chains requests across endpoints and roles. For example, it logs in as a low-level user, grabs an object ID from one endpoint, and tries to use it somewhere else. That's how we catch bugs no single request would find.

On average, Perfai finds dozens of critical vulnerabilities and active data leaks, and it fixes them instantly too. Full coverage across UI, API, data, and roles, at a fraction of pentest cost.

Try it free at perfai.ai. Just enter your app URL to start. We're also giving away 50% discount codes for the launch. If you need extra credits or help onboarding your app, reach out to me anytime. Happy to help!

Thank you@zerotox You can get the first results in minutes, but yes it scales with complexity and may take up to 1 hour based on the load. The work is proportional to your access-control matrix (roles × data objects × actions), so a small app is minutes and a large multi-role one takes a bit longer. But we're talking minutes-to-hours vs. the weeks a manual pentest of the same surface would need. And because it's that fast, you can re-run the whole thing on every deploy.

@zerotox 
Thank you!

You guessed right, it depends on the app. The agents explore every page, API, and role combination, so a small app finishes in under an hour, while a large app with many roles and data types can take a few hours.

The good news: it's fully hands-off. Paste your URL, and the agents do the rest, including signing up their own test accounts. You can watch the live activity log while it runs, and the full pentest-style report lands when it's done. Re-tests after app updates are faster too, and drift detection flags what changed.

Try it free at perfai.ai. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@ankur_jeswani Appreciate the comment! This integration already works today. Drop in a GitHub Actions step (our CI/CD API is built for it): it triggers a scan, waits, and fails the build on new Criticals with a dedicated CI service-account role, job-id idempotency so retries don't double-scan, and auto-created GitHub issues for findings. It's a copy-paste snippet from our docs right now; one-click Marketplace Action is next. Happy to send you the snippet

@ankur_jeswani 
Testing after every deploy is exactly where this should go, since apps change fast and stale results lose value.

The good news is our setup makes this easy to build. Since a test only needs your app URL, a GitHub Action just has to hit our API after deploy. No agents, no repo access needed.

In the meantime, you can trigger re-tests in one click, and we do drift detection, so when your app changes, we catch new gaps that the last test couldn't see.

I'd love your input on how you'd want the Action to work (fail the build on criticals? just report?). DM me and let's shape it together.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

Great question @iamanantgupta 

We start by learning what access is intended. Perfai Security reads the app's UI and role structure to find the base for who's meant to see what before building a permission map from it. Then we replay the same API calls as different users, roles, and tenants and compare what actually comes back.

The distinction is in the response. We only flag it when a user actually receives unauthorized data they were never meant to see. If the endpoint returns their own data, an error, or empty results, that's intended behavior and we leave it alone. We go a step further by excluding resources that are shared by design.

Above all of this, we surface permission anomalies such as cases where the app's real behavior contradicts its own intended access model (a user who should be blocked isn't, or an authorized user is wrongly denied). That's how we separate deliberate permissions from genuine broken-access-control, IDOR, and privilege-escalation issues.

@iamanantgupta 
Thank you! This is one of the hardest problems in access control testing, so great question.

Here's how we approach it. Our agents first learn your app's intended permission model by exploring what each role sees in the UI. If a page, button, or data field never appears for a role, but the API still serves it, that's a strong signal of an unintended gap. The UI is basically your app telling us what you meant to allow.

We also weigh the data itself. A viewer role reading a public blog post looks intentional. A viewer role pulling another user's private records through a direct API call almost never is.

And for edge cases, you can mark a finding as intended behavior, and we won't flag it again in future scans. Your feedback tunes the results to your app.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

Really appreciate the kind words,@vikramp7470 !!
Our access control testing platform compliments DAST / SAST testing tools that already test for injection flaws. And so as to not compete, but rather ensure the un-addressed majority of threat categories are secured against, we built Perfai Security around access control vulnerability testing.

@vikramp7470 

Thanks for the upvote!

Straight answer: no, we don't run injection tests like SQLi or NoSQL injection. That's by design. Injection attacks can damage a live app's database, logs, and third-party integrations. We built Perfai to be production-safe, so we stay away from that category on purpose.

Our focus is access control: BOLA, broken role permissions, and data exposure across UI, API, and data layers.
Our agents chain requests across endpoints and roles to find the gaps that single-request scanners miss. That's where most real breaches happen, and it's safe to test on live apps.

For injection coverage, we pair well with a code scanner or a scheduled pentest. Think of us as the layer that covers what those tools can't see at runtime.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

Hi! This is our home turf @syed_shayanur_rahman Multi-tenant SaaS is where access control gets brutal, and it's what we test hardest. The Vision Agent builds a per-tenant identity map with every role across your hierarchy (org → workspace → team → resource, plus nested roles and inherited/overridden permissions) and the Security Agent then attacks on two axes: horizontal being classic cross-tenant isolation breaks and vertical being whether a member can escalate to admin/owner inside a tenant. It reasons over the effective permission, not the declared one, so inheritance quirks and role-override edge cases get exercised. Cross-tenant leakage is the highest-severity class we hunt.

@syed_shayanur_rahman 

Great question. Multi-tenant SaaS is honestly where Perfai shines, because cross-tenant data leaks are the scariest access control failures out there.

Our agents map your app's roles, data types, and actions, then test the combinations. That includes tenant boundaries: can a user in Company A reach Company B's data through a direct API call, a shared object ID, or a side door the UI never shows? Those are exactly the bugs that hide in complex permission hierarchies, and no single-request check finds them.

For hierarchies like org admin, team admin, member, and viewer, we prove what each level can and cannot reach across UI, API, and data. The agents sign up their own test accounts where possible, and you can add accounts for roles that need invites.

Drift detection matters here too, since permission models change as you ship new features.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@roopreddy thank you, and great distinction to draw. Access control is business logic. It's the highest-value slice of it, and the one missed most often. So that's where we go deepest: BOLA/BFLA/IDOR, privilege escalation, cross-tenant isolation, multi-step workflow authz.

But we don't test at the "is there an auth check?" level. The Vision Agent builds a semantic model of your app with the roles, objects, actions, state... all taken into account. And our Security Agent can reason about the intended rules and then try to break them, such as:

• skip a workflow step

• replay a state transition

• mutate an object you own to reach one you don't

• chain a privilege escalation

That's all 'logic'-level attacking. Pure economic-logic abuse (price/coupon/quota manipulation, business-invariant races) is what we're expanding into next. Want to see what it flags on yours? You can use our discount code to get 50% off on the Pro plan (in pinned comment)

@roopreddy 
Thank you!

Great question. Our core focus is access control: roles, permissions, and data exposure across UI, API, and data layers. That's where most real-world breaches happen.

But there's a lot of overlap with business logic. Since our agents learn your app's actual workflows, they catch logic gaps tied to access, like skipping steps in a flow to reach data you shouldn't, or performing actions your role shouldn't allow. Pure business logic bugs like pricing errors aren't our focus today, but the access side of logic flaws is well covered.

Try it free at perfai.ai and see what it finds. You get a full pentest-style report with every scan. We're also giving away 50% discount codes for the launch. If you need extra credits or help onboarding your app, just reach out. Happy to help!

Hello@jared_salois I'm particularly excited to answer your question! 

Raw vuln counts are a vanity metric. And you're right... what slips through is the real test. A few ways we attack the false-negative problem head-on:

We measure against a known denominator. The Vision Agent enumerates the full access-control matrix (roles × objects × actions), so we report coverage (what share of that surface we actually exercised) not just a pile of findings. You see what we tested, not only what we caught.

Gaps are reported as gaps, never as green. An auth wall we couldn't cross, or a path we lacked credentials for, or a flow needing business context we can't infer ("this discount should never apply to enterprise SKUs"), etc. All those surface as explicit coverage gaps, not a false "clean."

"Looked clean, found later" is a first-class case. Every deploy gets re-tested, and as our attack models improve, we re-scan existing apps. So yesterday's "clean" can legitimately become today's finding. Coverage is a living thing, not a one-time snapshot.

And every finding is exploit-verified, so what you do get isn't diluted by false positives. We'd rather hand you an honest "here's what we didn't reach" than a green checkmark that lies.

@jared_salois 

Thank you! And this is one of the best questions we've gotten.

Honest answer: yes, things can slip through. No tool catches everything, and anyone who says otherwise is selling you something.

Here's how we think about it. We're focused on access control, so bugs outside that scope (like injection or business logic errors) are not what we hunt. Within access control, our coverage comes from testing every role against every data type and action, so the misses tend to be edge cases like flows the agent couldn't reach, not whole categories.

When a customer or pentester finds something we missed, we treat it as a bug in our system. We add it to our test framework so every app we scan after that gets checked for it. That feedback loop is how our coverage grows.

If you want to see for yourself, try the free tier at perfai.ai. You get a full pentest-style report, so you can compare it against your own findings. We're giving 50% discount codes for the launch too. Need extra credits or onboarding help? Just reach out!

@nuseir_yassin1 yes! Because we test black-box from your app's URL, we authenticate through your real login flow using the test credentials you provide for each role. This way, Clerk, Auth0, Supabase Auth and the rest all work. We meet your app wherever it lives instead of needing a separate integration per provider. If you've got a specific setup in mind, let us know and we can confirm the exact flow.

Would genuinely love to have you run something through it.

@nuseir_yassin1 
Great question! We're auth agnostic. If a typical user can sign in to your app, our agents can too. Clerk, Auth0, Supabase Auth, custom logins, all work out of the box. Our Vision Agent handles the sign-in flow the same way a real user does, and it even signs up its own test accounts if your app supports sign-up.

The only limitation right now is MFA or OTP beyond email. Email-based OTP works fine, but codes sent to phones or authenticator apps aren't supported yet.

Once in, we run full access control testing across UI, API, data, and roles, with drift detection catching new gaps as your app changes.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

Much appreciated @himani_sah1 
That’s exactly what we’re trying to solve. With so many vibe-coded apps going live, security testing needs to fit the builder’s workflow. Perfai Security makes it possible for solo founders and small teams to deep-test access controls in live apps without needing enterprise security teams, long setup cycles, or manual testing expertise.

@himani_sah1 
Thank you! That's exactly the goal.

Security testing has always had a high barrier: expensive pentests, complex tools, or needing an expert on the team. Most builders just skip it. So we made the barrier one paste. Drop in your URL, and our agents explore your app, sign up their own test accounts, and test everything across UI, API, data, and roles.

No setup project, no security background needed. And with drift detection, coverage stays fresh as your app changes, so it's not a one-time check.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@elsedes really appreciate you trying it out and flagging that. Team's already looking into it.

@elsedes Here's an update: You didn't miss a step.. we had a security policy on our end that was blocking the "Test now" request. It's fixed now, so after a quick refresh, give it another try and you should go straight into the scan.

@calvin_russell1 yes, that's what it's built for. The Vision Agent doesn't just click the UI — it maps the underlying API surface (every endpoint it can discover), so a route that's hidden from the interface but still live on the backend gets found and attacked anyway. That "hidden-but-live admin function" is a class we explicitly hunt, known as shadow functionality (and broken function-level authorization (BFLA)). If the backend still honors it, we'll call it, prove it with a reproducible request, and hand you the fix.

@calvin_russell1 
Yes, and this is one of our favorite bugs to catch!

Hidden-but-live routes are classic access control gaps. The UI hides the admin page from regular users, but the backend never checks who's asking. Code review misses it, and clicking around the app misses it, because the door is invisible to the eye.

Here's how we catch it: our Vision Agent maps your app from higher-privilege views too, so it knows the admin routes exist. Then the Security Agent tries reaching those routes and APIs as lower roles. If a viewer account can hit a live admin endpoint the UI never showed them, that's a finding, with the exact request that proved it.

Hiding a button isn't security. The backend has to enforce it, and we test that it does. And with drift detection, if a new route ships next week without protection, we catch that too.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@trevor_nicholas2 honest answer: if a manual pentester checks ~50 permission combinations before the clock runs out, Perfai Security tests all 6,000+ (across every role × data × action) ...including the weird ones, including chained privilege escalation, cross-tenant ownership quirks, admin functions live under a hidden route. These "edge cases" are usually just cases nobody had time to reach by hand, but in practice, we've surfaced findings a decade of manual pentests had missed. Where a creative human still shines is open-ended business logic, and we're pushing into that too.

@trevor_nicholas2 

Fair question, and the honest answer is: humans and machines catch different things.

A skilled pentester might spot a weird one-off flaw with creativity. But humans have limited time. They test for a few days, sample some endpoints, and move on. Our agents test everything: every role against every data type and action, thousands of combinations a human would never have time to try. Weird edge cases often live exactly in those untested combinations.

And here's why our focus matters: Gartner reports that access control issues account for about 50% of breaches and security incidents. That's precisely what we go deepest on. In total we cover 75+ AI-threat categories, spanning access control, auth, and classic categories.

Plus a pentest is a snapshot. With drift detection, we keep testing as your app changes, so you're covered next month too, not just today.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

Hello @reid_anderson4 , great question!

Those are broad AI-pentest / DAST scanners that are good at surfacing known vuln patterns across an app. Perfai Security goes deep on the one class generic DAST structurally does not cover: broken access control (OWASP's #1 for four years running). We don't just fuzz URLs... our Vision Agent first maps every role × data × action, then the Security Agent attacks the permission model itself: BOLA/IDOR, BFLA, privilege escalation, cross-tenant isolation.

Every finding is exploit-proven, and the Fix Agent ships the patch into your AI coding tool and re-tests to confirm it's closed. In a different lens, they scan the surface, whereas we break the authorization logic.

Hello!
I'm a Mechanical Engineer from Japan, and I'm expanding my engineering business into the U.S. market. I'm looking for U.S. citizens interested in a long-term collaboration.

Could you help me with my business?

@paige_lauren2 readable solo 🙌. You do NOT need to possess technical knowledge on what IDOR means — each finding is plain language with OWASP/CVSS/CWE detail tucked in for the dev folks who want to go deeper. And you don't have to interpret it to fix it. The Fix Agent hands the exact patch to your AI coding tool (Cursor, Claude Code, Replit, Lovable…) and re-tests to confirm it's closed. Security expertise is optional... that's the whole point. Try it free at perfai.ai, first finding in ~20 min.

@paige_lauren2 
Totally readable solo! We built the report for people shipping apps, not just security pros.

Every finding is written in plain language: what the issue is, why it matters, and what could happen if you leave it. So instead of just "IDOR detected", you'll see something like "a viewer account was able to open another user's private records by changing an ID in the request". You see the exact request that triggered it, so nothing feels like a mystery.

And you don't need to know how to fix things either. Every finding comes with a one-prompt fix for your code agent, like "Fix Critical" or "Fix #2". Find, understand, fix, done.

For those who want depth, findings also map to standards like OWASP and CWE. But you never need that to act on the report.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@oliver_hayes1 you can paste-and-go for a fast first look 🙂, but for the real value, hand it a couple of test accounts. Access control is all about who can do what, so the high-severity findings like cross-tenant data access, privilege escalation, BOLA will only surface when the agent can log in as different roles and try to cross the boundaries between them.

Hello@oliver_hayes1 

I'm a Mechanical Engineer from Japan, and I'm expanding my engineering business into the U.S. market. I'm looking for U.S. citizens interested in a long-term collaboration.

Could you help me with my business?

@oliver_hayes1 
Great question! Just paste the URL and walk away. Our Vision Agent explores your app on its own, maps the pages and APIs, and even signs up its own test accounts if your app has sign-up. From there it runs deep access control testing across UI, API, data, and roles.

The only time you'd add test accounts is if your app doesn't support self sign-up (like invite-only apps). Then you just drop in credentials during setup. Takes a couple minutes.

And with drift detection, we keep catching new gaps as your app changes, so it's not a one-time thing.

Here's a quick demo so you can see the flow: https://www.youtube.com/watch?v=04BtCSA8dqQ

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

Much appreciated!! @crystalmei  Perfai Security looks at the running app from the URL you give it. That's exactly what "live vulnerabilities" means. We test the deployed, running system the way an attacker actually hits it, not static source analysis, andso we need zero codebase access to find issues. Where it plugs into your workflow is the fix side. The findings flow back through an MCP server (perfai-mcp-server) you drop into your IDE (Cursor, VS Code, Claude Code…), and into CI/CD via a GitHub Actions step so every deploy auto-re-tests.

@crystalmei 
Thank you!

We test the running app, not the codebase. That's a deliberate choice. Code scanners can't see runtime behavior, like an auth gap that only shows up when requests happen in a certain order, or a role that can reach data it shouldn't. Those bugs live in the running app, so that's where we test.

It also makes setup dead simple: just enter your app URL. No repo access, no CI config, no agents to install. That fits vibe coding perfectly, since the code changes constantly and often nobody's reading it anyway. Ship your app, drop the URL in, and re-scan after big updates.

Our agents test across UI, API, data, and roles, so you get full app coverage no matter what tool wrote the code.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@galdayan great question, you decide what Perfai Security points at. You hand us any base path or app URL. The aggressive, state-changing pass runs against a staging environment, a preview deploy, or a clone/snapshot, not necessarily your live prod. The blast radius is your call, not ours.

And even then, proving an access-control break almost never requires destroying data. For "mutate an object you own to reach one you don't," the vuln is proven the moment the system authorizes the cross-boundary action for the wrong principal... making the 'authorization' the finding. We assert that the boundary is crossable but we don't complete the destruction to prove it. So the check never depends on a destructive write, and anything genuinely state-changing you route to the staging/clone URL you give us.

You can sign up free at perfai.ai (or 50% off the Pro plan with our Product Hunt discount) and I'd be happy to connect and walk you through pointing it at a staging clone.

@galdayan Really good question. You're right that this is where most testing tools get risky.

Perfai Security is production-safe, unlike regular pentesting. Here's why:

We don't run injection attacks at all. Those are the tests that can damage your app, database, logs, APIs, containers, and third-party integrations. We focus on access control testing, which is safe by design.

The agent also uses its own test accounts, not real customer accounts. When it checks if it can reach data it shouldn't, it's testing if the door opens, not pulling customer data. For risky actions like updates or deletes, it only tests against objects it created itself. Real records are never touched.

So the test itself won't cause the damage it's trying to prevent. That safety is core to how we built it.

Try it free at perfai.ai and get a full pentest-style report of your app. We're giving away 50% discount codes for the launch too. If you need extra credits or help onboarding, just reach out. Happy to help!

@divya_kothari1 great question, and yes. You run different profiles per environment. You can go deep and aggressive in staging with seed test tenants, exercise state-changing and destructive attack paths, full-matrix coverage... because nothing's at risk. On production it runs in a safe, non-destructive mode (read-only checks, no mutating actions) so always-on monitoring never touches live data.

@divya_kothari1 
Thanks! You're right, so many apps ship now with no security review at all. That's exactly who we built this for.

For teams with devs, yes, there's room to tune things. You can set up separate apps in Perfai for each environment, so your staging and production scans run with their own settings, credentials, and roles. Since Perfai is production-safe by design (no injection attacks, test accounts only, no real data touched), you can run full-depth scans on production without worry. That's a big difference from regular pentesting.

Devs also get detailed findings with the exact request chains that triggered each issue, so fixes are fast.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help getting your team's apps set up? Just reach out. Happy to help!

@irahimiam spot-on! Both modes exist, but automatic is the whole point. You can fire a run manually anytime (one prompt / paste-URL), but the real setup wires it into your pipeline so it runs automatically on a scheduled basis or with each deploy... GitHub Actions steps (or our CI/CD API / deploy webhook) can trigger the scan, wait, and fail the build on any new Critical. Each run diffs against your last clean baseline, so you only hear about what changed, not the same list again. Set it once and every future deploy can re-test itself.

Hi @thys_beesman , thanks for asking. Perfai Security offers both, and this is where Perfai Security really shines. We don't just stop at a list of vulnerabilities.

We ship an MCP server (perfai-mcp-server) you drop into your IDE (Cursor, VS Code, or any MCP-compatible agent). Once connected, it pulls your reported issues directly into the editor, and for any issue it generates a context-rich fix prompt with exact endpoint, vulnerability, remediation contexts. Your IDE's coding agent then implements the fix right in your codebase, following your existing patterns and architecture.

We deliberately keep the developer in the loop rather than auto-patching your repo. This way, we never require any code-access. And so the fix lands in your editor where you review and merge it like any other change.

So it's detection → guided remediation → fix, without Perfai Security ever writing to your code behind your back.

TL;DR — Perfai Security maps your app, detects vulnerabilities, provides the fixes, and then retests to verify the issues are patched.

@thys_beesman 

Great question! Both. We detect and fix.

Every finding comes with an instant fix you can apply with one prompt in your code agent, like "Fix All", "Fix Critical", or "Fix #2". You don't need to be a security expert or spend hours figuring out how to patch each issue yourself. The Fix Agent hands you exactly what to do.

That's the full loop: our agents test your live app across UI, API, data, and roles, find the gaps, and give you one-prompt fixes. And with drift detection, we catch new issues as your app changes, so you're never relying on a stale report.

All this without paying thousands for a pentest. You get a full pentest-style report on the free tier at perfai.ai. We're also giving away 50% discount codes for the launch. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@maaz_b_tariq_shaikh 

Great question! This is exactly why we keep a human in the loop. Perfai suggests the fix, but your team reviews and applies it. Access control changes can break real user flows if applied blindly, so we never push changes to your app ourselves.

Each finding comes with proof of how we exploited it, so your developer knows exactly what to fix and why. After you apply the fix, just re-run the test. Perfai verifies the issue is gone and that your other permission checks still pass. Our drift detection also keeps testing as your app changes, so if a fix causes a new gap later, you'll catch it fast.

Try it free at perfai.ai. Use code PHLAUNCH50 for 50% off any paid plan. Full pentest-style report included. Need extra credits or onboarding help? Just message me!

@zohaib_akmal 
Thank you! Your team's experience is exactly why we built this. AI guardrails help, but they can't replace real testing, and doing it by hand eats hours.

Perfai Security does that testing for you. Just enter your app URL. Our agents sign up their own test accounts, then test thousands of permission combos across roles and actions. You get a pentest-style report with proof for every issue. We also run drift detection, so new gaps get caught as your app changes.

Try it free at perfai.ai. Use code PHLAUNCH50 for 50% off any paid plan. If your team wants extra credits or onboarding help, just message me!

@ercan1811695 
Thank you! That friction was exactly what we wanted to kill. Security tools usually ask for weeks of setup before they find anything. We wanted the opposite: paste your URL, get results.

Our agents even sign up their own test accounts, so there's nothing to configure. They test thousands of permission combos across roles and actions, then hand you a pentest-style report with proof for each issue. And since vibe-coded apps change fast, we run drift detection to catch new gaps as you ship.

Try it free at perfai.ai. Use code PHLAUNCH50 for 50% off any paid plan. Want extra credits or help getting started? Just message me!

@jim_verducci 

Thank you so much! This comment made our day.

Wristband is exactly the kind of use case we love: a multi-tenant auth platform where tenant isolation has to be right, every time. Watching your team use Perfai to prove authorization rules behave as expected, across every update, is the product working exactly as we dreamed. Auth platforms hold everyone else's front door keys, so the bar is highest there.

And the kind words about the team mean just as much as the product praise. Working with you all has been a pleasure for us too.

For anyone reading: this is what Perfai does. Test your live app's access control across UI, API, data, and roles, with drift detection catching gaps as you ship. Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch. Share your app URL and I'll get you a free report personally. Need extra credits or onboarding help? Just reach out!

@benjamin_riou 
Thank you for putting it that way. That knot of worry is exactly what we're trying to untie.

Shipping fast should feel exciting, not scary. But so many builders hit publish and then lie awake wondering what they missed. Nobody should need a security team just to breathe after launch. That's the whole reason Perfai exists: something quietly watching your back, testing every update, catching the gaps before anyone else does.

Comments like this remind us why we build. Thank you.

If you ever ship something, the free tier at perfai.ai is there, with a full pentest-style report and drift detection as your app grows. We're giving away 50% discount codes for the launch too. And if you need extra credits or help onboarding, just reach out. Happy to help!

@ridhwikvinod You're pointing at the part we care about most. Verification isn't an afterthought, it's a core part of the workflow.

Once a fix is applied, Perfai re-runs the original exploit to make sure that specific issue is actually gone. We don't consider a vulnerability fixed until the attack no longer works.

We also re-map and re-test the application after every change. That's important because an AI generated fix can solve one problem while unintentionally introducing another. The re-test is there to catch exactly that.

The end result is a clear verdict for every finding, backed by proof instead of assumptions.

Feel free to try it.. it's free at perfai.ai

@ridhwikvinod 
Thank you! And great point. An AI fix without verification is just more vibe code.

Yes, we re-test after every fix. The agent re-runs the exact request chain that triggered the vulnerability to confirm it's closed. And since re-scans only need your app URL, running a full scan after patching is one click, so you can confirm the fix didn't open a new hole somewhere else.

You also review every fix before it ships. The agent shows you what it changes and why, so nothing load bearing gets touched blind.

That's the loop: find, fix, verify. Not just find and hope.

Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!

@aidanhornsby Since Toyo handles autonomous workflows like inbox triage and outbound outreach, what specific guardrails or 'human-in-the-loop' confirmation steps are in place to ensure the AI doesn't send inaccurate information or violate communication preferences with sensitive VIP contacts?

@aidanhornsby Really like the idea of keeping AI where work is already happening instead of adding another app to manage. The mix of messaging, voice, and pulling context from company tools makes it feel much more like a true assistant than just another chatbot. Excited to see how teams use this day to day—great launch!

@aidanhornsby Really impressive launch! Since Toyo integrates with multiple productivity tools, how do you handle conflicting context across different data sources? For example, if calendar events, emails, and messages suggest different priorities, how does the agent resolve that before taking action?

@dctanner S/O for the great work! curious how you use @Toyo personally? what are your favorite use cases?

Hello @dctanner 
I'm a Mechanical Engineer from Japan, and I'm expanding my engineering business into the U.S. market. I'm looking for U.S. citizens interested in a long-term collaboration.

Could you help me with my business?

Whatsapp : +1 361 247 1247

Email : kai2026@cleverbiz.us

@dctanner the "never ending single conversation" part is what I'm most curious about mechanically. months of iMessage history plus 1,000 connected MCP tools is a lot to keep live in context. is there some rolling summarization/compaction happening under the hood so old threads don't get forgotten, or does it lean more on re-fetching from the connected tools each time rather than remembering the raw conversation itself

Thanks @artstavenka1! Yeah this is definitely an area we've invested a lot to tune the experience to feel right. We couldn't be here without the amazing team + infrastructure of @linq which is powering this part of Toyo!

We're very excited to build on this with iMessage apps which they just launched last week: https://linqapp.com/blog/supercharge-your-agents-with-imessage-apps 

Thank you @fmerian! That's very kind. It's a crazy time to be building and launching products and the pivot from @Layercode was only obvious after the fact.

As we were building the voice AI platform we increasingly felt that despite voice dictation exploding in popularity, conversational voice is a really overlooked way to give agents rich context — it's so natural to verbally dump context to an agent that asks questions).

Alongside that, we observed that many builders and founders were spending increasing amounts of their time building, experimenting with, and maintaining their own internal AI agents to the point that they had created multiple new full-time jobs for themselves and their teams. A totally new kind of busywork that didn't exist even a year ago.

That to say, Toyo is the result of us becoming incredibly passionate about these two insights and we want to try to give more people access to the promise of an AI agent that can communicate with them wherever is easiest, and actually help them get real work done without all the engineering headaches.

@priyatharshini_c Thanks so much! So glad it resonates. If you have any feedback please share — we're prioritizing building feature and integration requests and shipping fast 🚀

awesome! let's spread the word on X, repost this

@aseldover13449 there's a few ways:

1. Foundational/high level context (what the business does, what tools you use, etc) primarily gets pulled from (1) a scrape of your website and (2) what you tell Toyo during your onboarding (text + phonecall)

2. More timely/less evergreen context is drawn from the tools you connect: Email, Slack, calendar, etc.

Different companies store key information in many different places but we've found connecting Notion and Slack is very helpful to give Toyo a good understanding of what's going on in your organization.

This is a very big challenge to get right though — especially as what is important and timely evolves slowly over time, and many tools like Notion do not store their data in ways that is optimized for agents. We have some strong opinions on this and are building something to help solve this as elegantly as we can — watch this space!

@nealogrady I appreciate that because it took me more time than I'd like to admit to get image models to produce adorable VS horrifying for some of those shots 😂

@jessema great question! Reliably having to actually check my inbox less has definitely been a really nice daily value add.

I think the most surprising for me has been the difference made by giving Toyo a TON more context about how me and my brain work. I gave my Toyo the agent-optimized personality report from @Deep Personality and it seemed to level up the quality of my daily updates (what's included, prioritized, how they're framed) and just generally tuned how my Toyo speaks to me to feel like it 'gets' me on a personal level.

My 'woah' moment so far is not having to check my inbox when I wake up and instead getting all urgent emails and news summarized into a single text from my Toyo

@jessema lfg! make sure to leave your review here: https://www.producthunt.com/products/toyo/reviews/new

@dursunltxo thanks for your support! please help us spread the word on X, repost this

@erinsullivan great example!

people can learn more about this capability here btw: toyo.ai/capabilities/newsletter-summaries

ping @aidanhornsby who made this awesome claymotion launch video

@raghu_mohan1 Thank you so much! It was a lot of fun to make but all done with internal tools I built: Claude, Codex, Open AI image API, Replicate w/ Seedance 2.0, Grok Imagine & a lot of Final Cut Pro.

I'm gonna write up a bit more about the process soon!

Love that it actually calls you instead of just living in a chat window.

@irahimiam spot on! been following their team since the early days, and what struck the most is the level of thought and craft they put into what they're building. result: a product beautifully executed and actually helpful.

give it spin: toyo.ai

S/O to the 🐐 @aidanhornsby for this claymotion launch video!

Thanks @hamza_afzal_butt!

Let us know if you have any questions or need help getting set up 👍

thanks for your support, Hamza! give @Toyo a spin at toyo.ai

and add your review here: producthunt.com/products/toyo/reviews/new

enjoy!

@noice30sugar  appreciate that! Thank you man.

So, a bit on each piece:

• Context: every company gets its own isolated cloud workspace, and Toyo's context is built fresh from it each turn — what it's learned about your business, its memory, and the live thread. When it gets long, Toyo summarizes and hands off to itself instead of forgetting.

• Memory isn't a black box! Actually, it's plain ol' markdown in your workspace that Toyo reads and writes. Super simple.

• Guardrails are mostly architectural: what 'thinks' — model orchestration, your keys, integrations — runs on @Cloudflare Workers, kept separate from what 'acts': sandboxed, per-company containers that never hold your credentials. Plus per-company isolation, capped spend, and a confirm step before anything irreversible.

On company context + memory specifically: we're running an internal

prototype of something really cool here... watch this space! Can't wait to

share soon.

@anderhole icymi use PRODUCTHUNT at checkout to try out @Toyo for one month free

get started at toyo.ai - enjoy!

@chielephant yeah it's a real voice agent! It has access to all of the same context and memory that Toyo does over text, so you can talk to it the same way as via iMessage.

Voice vs text is a very personal preference but generally I think it's useful when you're on the go. Personally:

• I used it a ton when I was exploring Tokyo last month, asking it for recommendations on some sightseeing and actually having it explain to me the difference between some different Pokemon card products I was trying to pick up for a friend's son, lol.

• I also have called it a few times when I wanted to brain dump some ideas into a note to turn into a content draft that I could pick up when I was back at my desk.

@luki_notlowkey Yes! We are going to continue invest in integration and MCP support to make it easier to connect almost any tool or data source to your Toyo!

@krekeltronics framing this! spread the word on X, repost this

@oguzperdah4102 great question! and yes, @Toyo plugs in to @Linear, @Notion, and the tools you already use to run your business via MCP integrations. see everything it can do here: toyo.ai/capabilities

hope it helps!

thanks for your support, Henry! and great question.

from a security standpoint, @Toyo is built on @Cloudflare. every agent operates in an isolated, sandboxed environment. your data never leaves your environment.

cf cto @dok2001 put it simply:

By leveraging Cloudflare, Toyo can deliver performant and secure AI agents at scale.

hope it clarifies - give it a spin: toyo.ai

great question! @dctanner wrote about this in more detail in this blog post: Why we cancelled our entire SaaS stack, and how we built what replaced it

tl,dr: they cancelled their CRM, their email automation, their website builder, their prospecting tools. all of it.

over to you! toyo.ai

@thys_beesman For me it's meeting prep. I have my Toyo research all the attendees for an important meeting, then call me and give me the background on each one, then we discuss whatever prep exists for the meeting (slides or pdfs) - and go back and forth to align on what's important to cover. Then usually I have it write a summary for whatever my part in the meeting is that I need to cover.

@thys_beesman Great Q! For me: I used to check my inbox reflexively throughout the day and would get distracted by things that were neither urgent nor important.

We spent a bunch of time how Toyo scans, labels and helps manage your inbox and I am finding it very reliable for me at pinging me when something time-sensitive actually hits my inbox. As a result, I actually don't check my email anywhere near as much, which is saving me from those distractions. I feel that in my day and it's awesome.

(the email logic is fairly opinionated, actually. huge shoutout to @stuartbowness & @charles_catta for building an refining how it works today — more info here if interested: https://toyo.ai/capabilities/inbox-triage).

The “lives in iMessage and calls your phone” part is interesting because it suggests Toyo can handle both async and more urgent workflows.

@crystalmei spot on!

picture this: you're waking up. @Toyo has already scanned your inbox, tracked competitor changes, and flagged what matters. you get a 2-minute brief tailored to your current priorities. not a notification flood, not another dashboard.

get started at toyo.ai

@crystalmei Good question! Right now there's two ways:

1. Ask Toyo to call you reactively (good if you want to do something like talk through an idea for a piece of content or team update you need to get drafted, and hand off the outline/first draft to Toyo, etc)

2. Ask it to call you on a schedule with a specific prompt or instruction. This is more useful for things like a daily update every morning (something that is useful in text but some people prefer a call because they have commute at the same time every day, etc).

@felix94123 One API key to hundreds of models, hosted in the EU and drop-in compatible with the SDKs teams already use — that's the combination that makes switching painless, and the European hosting is a real, specific reason to choose you over the default.

A gateway shows its value better in motion than in a description, and you launched without a demo video — so I made you one, free and whitelabel, no strings:

https://www.youtube.com/watch?v=RlB6e2Hwxk4

Yours to keep — download it from https://foxplug.com/v/ss-opper-launch-the-european-ai-d289407f and put it on your own channel or launch page. Launches with a video do better, and yours is still editable.

Made at https://foxplug.com/?utm_source=producthunt&utm_medium=comment — make more there, or record your own product tour in ~2 minutes. Anyone else launching soon: paste your site, video in about 30 seconds. Nice work.

Thanks @tom_dickson1 and yes that's exactly right. You can even set this as a fixed routing rule so you or anyone in your team can't switch the region by accident. Happens more than one would think :)

@goran_sandahl 100%

@ulykbek11 Spend caps are enforced once per request, at the gateway on the way in, not per model call. So when an agent chains several models back-to-back (or falls back primary→fallback₁→fallback₂), the cap is checked once up front and never re-checked between calls. You don't need to pre-check before each call, and nothing gets killed mid-chain: if you're over a cap, the next request gets a clean 402 before any model runs. Two things worth knowing:

• Metering is eventually-consistent (spend is debited after each call and batched before it hits the ledger), so a long chain or a parallel burst can overshoot the cap slightly before the block kicks in on the following request. For "stop runaway spend" that's exactly what you want; if you need a hard per-call ceiling, gate on balance yourself between calls.

• Failed fallback hops are free — you only pay for the model that actually delivers tokens, not the ones that erred and fell over. And if you're already over the cap before the call, you never reach the fallback at all; you get the 402 up front.

Thanks @irahimiam! You can either set it as a fixed rule in your route settings or choose EU as a region when setting the model in the platform. You can also filter in our public model list and copy the API ID directly: https://opper.ai/models?region=EU

@nielsbosma it's a match! 🤝

@priya_kushwaha1 yes!

We offer compatability endpoints for Anthropic (messages), OpenAI (chat completions, responses, open responses), Google (interactions) and allow for using the right endpoint for the right model to avoid lossy translations. For many use cases all models can be used across all compat endpoints, but to get the most advanced feature access we recommend using the right endpoint.

Some things we are looking very closely at:

- Caching
- Tool calling
- Structured output
- Provider server side tools

@cody_spencer good question, we wrote an article about that, and routers do not inherently add latency: https://opper.ai/blog/llm-router-latency-benchmark-2026

@brandon_chase we engage with providers and have them sign their DPAs. But we can all do better to verify claims! We expect the industry to mature

@denitsapenchevavaltchanova yes go europe!! 🚀

@nevzatyolag2y3 great! Let us know if you have any feedback or questions!

@conduit_design yes very good point, we may be working on something in that regard but can't disclose too much yet. Stay tuned 👀

@nileback thanks so much, great to hear from a happy customer 🙏

@amjad_shaik our gateway tier is by design very light and zero data retention because it is very important for some that either need privacy or low cost. On our control plane tier we add options to add tracing with configurable retention, guardrails etc. We hope this strikes a good balance. Thanks for engaging!

@jack_sullivan5 do you see this as negative for the users? Thanks

Thanks@alieksia ! For your data to stay fully within the EU, you have to choose a model with EU hosting availability. We offer this out of the box for almost all models, even for leading ones like Claude Opus 4.8 with several providers, so you can even have a fallback. Fallbacks is also why you would want a router, imagine you use Claude Opus 4.8 on AWS Bedrock and they have an outage, then your app / access is also down. By choosing another provider, e.g. Azure as a fallback, you ensure that you have continued access to Opus 4.8. And outages / ratelimits have been very common in the past. There are many more reasons, like having the ability to switch to other models for specific tasks so you don't pay $$ premium opus tokens for a basic task that 10x cheaper open-source models can easily handle.

@tribaling thank you for the kind words ❤️

@myroslav_budzanivskyi  @konstantin_karpushin1 Since Lispr is designed around speed and simplicity, how are you thinking about adding more AI-powered features (like rewriting, summarization, or contextual actions) without compromising that near-instant experience? As we're building Juno AI, we've found that every additional AI capability introduces trade-offs between latency, UX, and cognitive load. Curious how your team decides where to draw that line.

@henry_s_jung Thanks Henry! System-wide: anywhere you can put a cursor, you hold the key and talk. Per field, not per app, so it works in random Electron apps, browser inputs, terminals.

And agreed on transcription being the easy part. For us the hard bits were speed and consistency: we start streaming audio to the model before you finish speaking, run a quality check before the text lands in the field, and route recognition to the nearest region (Asia to Asian servers, US to American) so latency stays flat wherever you are. Mic behavior across devices is its own separate pain, you have my sympathy there.

Congrats on shipping voice input yourself, and thanks for the kind words!

@katrya_syrotynska A review dictated through the product it reviews. That's the best QA report we got today 😄 Thank you!

"It doesn't write everything for me, but it cuts the time" is exactly the bar we aim for. Lispr types what you say and stays out of the rest. Curious which part of your day it took over first: the Slack messages or the briefs?

@crystalmei Thank you! I'm on the marketing side and use it all day, so here's the honest user answer.

Lispr doesn't change its behavior per app. It types what you said wherever your cursor is, the same way in VS Code and in a LinkedIn post. The difference is in how you use it. In coding tools I don't dictate syntax; I dictate prompts to AI assistants, commit messages, and comments, and that covers most of what a keyboard did for me there. Our CTO dictates code comments through it daily.

For marketing and social writing it's the main way I draft now: long text with full context comes out faster than I could type it.

Two things help across both contexts. It transcribes what you say without rewriting it, so your wording stays yours in both worlds. And there's a vocabulary feature, so product names and client names come out right instead of being "corrected" into dictionary words. It even learns new terms from your dictations.

If you try it in a specific tool and something feels off, tell me which one. The team ships fixes fast.

@pnarwmyy It doesn't translate mid-sentence, so there's nothing to get confused by. Nothing appears while you speak. When you release the key, the model gets the whole phrase at once and translates it with full context.

Names and technical terms pass through untranslated. And if a term ever comes out wrong, you can fix it in the vocabulary, and it stays fixed.

@martin_tanner Thanks, Martin! Right Ctrl is the default on Windows, but you can remap it in the settings menu. Fair point that this isn't obvious. We'll make the key options easier to find in the UI.

The download flag is a reputation warning. Chrome and Windows show it for any new executable until enough people have downloaded it, wherever it's hosted, so a common repository wouldn't dodge it. We sign every build and it passes the security checks; the warning ages out with download volume, as you guessed. Appreciate the heads-up.

@krekeltronics Thanks Patrick, you named the design principle better than we did. The trust boundary was a day-one constraint: the mic opens on key-down and closes on release, and macOS's own orange indicator confirms it, so you don't have to take our word for anything. Same reason there's no account. Fewer things to trust means fewer things to audit.

@umar_lateef Thanks Umar! A comment dictated with Lispr on launch day is the best kind of upvote. If anything feels rough in the first days of use, tell me here, that feedback shapes what we build next.

@galdayan Fair question, and thank you for reading the audit answer that closely. The vocabulary list is stored only on your device. There is no server-side copy and no install id it's tied to. So "remembers your jargon across sessions" means a local file on your Mac, not a profile on our side. That's how it reconciles with "no persistent identity": the persistence lives on your machine, nothing on our side persists between requests.

@toukoum Thanks Raphaël! On the trigger key: that's not normal, both left and right Option should work out of the box. We're checking the logs on our side right now. Can you tell me which keys you tried and your macOS version? Also check Lispr's settings menu: you can already pick a custom trigger key there, so if Option conflicts with something on your setup, switch it.

On money: the first 1,000 users got Lispr free forever, and the free tier stays for everyone with normal daily use. Down the road we'll charge heavy users, priced in line with similar tools in this space. Running costs are low, so keeping it free is not a trick.

And since you brought up money: if you have ideas on what you'd pay for, I'd love to hear them. That answer is worth more to us than the upvote.

@malikankush Thanks! Two differences matter most.

Speed. Lispr pre-warms the connection when you press the key and streams audio while you speak, so the production median is 346 ms from release to text. Side by side, that's the difference you feel in the first minute.

Translation. Hold a second key and your words land translated, in any of 32 languages. Wispr Flow transcribes in many languages but doesn't advertise translation. The case our users love: vibe coding. Models are trained mostly on English, and English prompts burn fewer tokens. So you think out loud in Ukrainian or Spanish, hold the translation key, and a clean English prompt lands in your terminal.

Also free, no account. Full comparison, including where Wispr Flow wins: lispr.ai/blog/lispr-vs-wispr-flow

@thys_beesman In transcribing the lectures (online or offline) to avoid writing down the lecture notes manually.

@thys_beesman Three surprised us.

The biggest: talking to AI tools, vibe coding above all. When your reader is a model, spelling and paragraph breaks stop mattering; the model understands context. So people speak two minutes of context and constraints instead of typing three sentences, and the output gets better. Half our team dictates prompts now, including in the terminal. Lispr's part in this is speed and fidelity: it types your words as you said them, anywhere, fast. The app never rewrites you. The freedom to be loose comes from who's listening.

Second: thinking out loud. Jeremy Caplan of Wonder Tools listed Lispr last week as a free alternative to Wispr, under what he calls "bionic dictation": talking through an idea before the editing impulse kicks in. We built a typing tool and people use it as a thinking tool.

Third is on this page: Katrya's review above, dictated with Lispr 😄

@myroslav_budzanivskyi Since Lispr relies on a cloud-based pipeline to achieve its ~350ms latency, what technical guarantees such as independent audits or ephemeral processing can you provide to ensure that my audio or transcripts are truly not being logged or used by your ASR providers, especially when I am not in a 'zero data retention' mode?

Nicely done, will have to try it out. I've been building the UX layer for my product heybono.ai and was waiting for a model that actually gets natural conversation flow (pauses, talk-over, latency) right.

Is this available via the API, or ChatGPT only? And how does it perform over a phone call vs. WebRTC when using the API, any latency differences between the two?

@mhdashiquek Since Aura operates on AST semantics instead of line diffs, how do you handle AI-generated refactors that intentionally change the code structure while preserving the same behavior? Is there a semantic similarity threshold or another validation layer before Aura decides whether a change is equivalent or genuinely introduces new logic?

@kellyops 

Great question, here's the honest answer:

Aura doesn't parse agent output at all. That's the key. It tracks changes at the AST level directly from the code on disk, not from anything Claude Code or Cursor emit. So when those tools change their output format, prompt, or diff style, there's nothing for us to break against, we re-parse the actual source files with tree-sitter and diff the syntax trees. The agent could hand us code by carrier pigeon; we only ever look at the resulting bytes.

Three things make the function-level tracking robust across agent updates:

1. Language grammars, not tool contracts. Function/class boundaries come from tree-sitter grammars per language. Those track the language, which moves slowly and independently of any agent vendor. A Cursor update can't shift where a Rust `fn` begins.

2. Rename-proof node identity. We identify logic nodes by structure and content, not by line number or name, so a function that gets renamed or moved is followed as the same node rather than counted as a delete + add. This is the same mechanism whether a human, Claude Code, or Cursor made the edit, the source of the change is irrelevant to identification.

3. Capture is at the git/filesystem boundary, agent-agnostic. Intent + AST snapshots hook in at commit/edit time on the repo itself. We deliberately built one renderer / one tracking path that any agent flows through, rather than an integration per tool, so there's no per-vendor adapter to maintain as they update.

So the maintenance burden isn't "keep up with N agents changing their output", it's "keep up with tree-sitter grammars," which is a much smaller, slower-moving surface that the whole ecosystem shares.

The one real edge is brand-new language syntax (e.g. a new language version adds a construct the grammar doesn't know yet), that's a grammar bump, not an agent-tracking problem, and it's the same fix regardless of which tool wrote the code.

I hope this helps, you can reach me at mo@auravcs.com if you want to discuss further or see how you can adopt it.

@chielephant 
That babysitting moment is exactly what we built the loop around, so the short version: Aura judges "done" by the goal, not by "the agent stopped talking." Every task carries an explicit goal, and after each pass Aura runs a proof against it, checking the logic your change was supposed to add actually exists and is wired in, plus tests and an intent-vs-change match. "Done" = that verdict comes back verified and the work commits cleanly.

The rewrite-spiral case falls out of the same mechanism: passes are bounded, and because each iteration is scored against the goal, a spiral shows up as iterations that keep running without moving the verdict (checks still failing / not wired). At that point the loop stops and hands the task back as failed, with the proof verdict attached, so instead of watching every diff, you get pulled in once, with a straight answer to "what's still not satisfied." It also flags when an agent's edits drift from the stated intent, which is usually the earliest signal a run is going sideways.

Fair disclosure: automatic rollback-on-failed-verify and worktree-parallel passes are still landing, today it stops and surfaces rather than auto-reverting, but the goal-anchored "is this actually done" check is the live core.

@noctis06 
Local-first, yes, the loop runs entirely on your machine. The desktop app and CLI drive your agent binaries (Claude Code, Codex, Cursor, Gemini) as local subprocesses, against your git repo. There's no hosted orchestrator in the path, the kick-agent → check-diff → prove → commit loop executes locally and works fully offline. The only cloud touchpoints are opt-in and additive: team awareness/collab sync, consent-gated anonymous telemetry, and our hosted "brain" if you choose it instead of your own binaries. Nothing about running agents against your repo requires our servers.

State lives in the repo, not a side store you babysit. Aura keeps two planes. Your code stays in plain git, untouched. The meaning plane, intent log, the goal/proof ledger, session records, lives in a .aura/ directory inside the repo and is git-tracked, so it travels through your normal git push/pull with no separate per-machine sync. Purely local artifacts (rewind snapshots, caches) stay on the machine by design and aren't something you need to move around. So: committed alongside git, portable with the repo, and readable/diffable like anything else in it.

@thedatadavis 

Hey Chris, really glad it landed that way, because that's exactly what we built it for. Aura isn't trying to be another heavyweight IDE you have to move into. It's a thin layer over the Git and terminal you already use, so you keep working in Zed with your Codex and Antigravity CLIs, Aura just runs underneath them.

That's where the "more advanced techniques" come in, whenever you want them, none of it forced on you:

• Drive any of your CLIs from one place and switch between them mid-task without losing the thread, one shared history across all of them.

• See what an agent actually changed in plain language (not just a wall of red/green), with a verdict on whether it really does what you asked.

• Hand it a backlog and let it work through tasks on its own, proving each one before it lands.

• Undo a single bad function surgically instead of rolling back your whole session.
  

And sorry about the site, you'd caught a broken link on our end, now fixed. Here's the working one:

👉 https://auravcs.com , Download's right on the page. Free, public beta, macOS + Linux.

It's also fully open source (Apache-2.0) if you ever want to look under the hood: github.com/Naridon-Inc/aura

Would genuinely love your take once you've played with it, especially whether it stays out of your way the way it should.

@robin_de_lacroix That black-box feeling is the whole reason Aura exists, Robin. The bet is simple: an agent shouldn't hand you a diff and a shrug. Every change it makes carries its reason in plain language, what you asked, what it did, and whether those two actually line up, so you're reviewing a decision, not doing detective work. And you don't have to take its word for it: it checks its own work against the goal you set and shows you the result. Trust should come from seeing, not hoping, that's the bar we're building to, and I'd love for you to hold us to it.

@feride130131 It can edit a part of the UI or regenerate a whole new interface

@kerem_ozman we had to temporarily disable that feature during AppStore submission, we're bring it back an improved version any day now.

@iamanantgupta we have a different memory model. The day of the conversation you can just continue your interactive sessions. After a while they are summarized into more semantic "conversations". If you discussed 2 completely different subjects , they will becomes 2 separate topics you can continue later

@localhost_ceo Since tasks.txt is designed as an open, text-based standard, how are you thinking about conflict resolution when multiple AI agents or collaborators modify the same task file? Do you envision versioning, merge strategies, or metadata becoming part of the specification, or do you prefer keeping the format intentionally minimal? we're building Juno AI, and this is something we've been discussing internally as AI assistants become more collaborative. Curious how your team is approaching that trade-off.

Thanks for the feedback@demirleng78497 ! I am a big fan of lean and powerful instruments and my philosophy for that kind of approach comes long way back when i started programming: redis, git, rsync - these are the tools i always loved. they do their thing and they do it perfectly.

Thank you so much, @galdayan !

Launching a basic version first was a conscious choice to see if people actually wanted a tool like this. Now that I've seen the feedback today, I have all the validation I need.

Cross-device sync and an iOS companion app are officially the next big priorities. Thrilled to have you along for the ride while it's still a desktop-first tool!

@tuncay2tva thank you! That’s exactly what I was aiming for. In my opininio the best productivity tools are the ones that feel completely invisible and let you save your brainpower for the actual work.

@qifengzheng This is the test I’d use too. If the file changes in another editor while Tasks.txt is open, I’d want it to reload safely or surface a conflict rather than silently decide which copy wins. “A file you own” becomes much more convincing when the app can coexist with the other tools that can edit it.

@qifengzheng yeah i specifically tested that one - if file is edited in any other editor, the changes will be reflected instantly in Tasks.txt

@chielephant Yes, it uses precisely todo.txt format, file is always readable with any other text editor. Here's an example of file format.

send business proposal to lead investor created:2026-06-04 upcoming:true
Call design lead +freelance created:2026-06-15 upcoming:true

Thank you@sergbmw

The app handles the cleanup for you - tasks completed today stay visible as a "win wall," and then get automatically moved to the Archive section at the end of the day.

Because it's just a raw text file underneath, your history is always there if you want to Git-track it or Terminal-search it, but the app keeps it out of your sight line so you can focus on what's next.

Thanks for checking it out @irahimiam !

The "Done" section is actually designed to auto-archive at the end of the day so you can see your daily progress before it clears out.

I didn't include a shortcut to purge the archive because I figured people wouldn't need to do it often, but you're right - for a keyboard-first tool, no need for using a mouse is the whole point. Would you prefer a shortcut to clear the archive entirely, or just a shortcut to manually archive a "Done" task?

@recep728172 What good is an isolated environment if it's not isolated haha. Glad you had a good experience!

@halit1241755 Yup, we pride ourself on providing this level of intelligence at a low rate. It should be accessible to everyone!

@chielephant Surely, if you have a workflow in mind please reach out to us, we are more than happy to fix it

@chielephant That's why we've focused a lot on our recovery systems and making sure the agent gets back on track for pop-ups and unexpected changes. It verifies the screen after every step.

@ekrem1698809 Thank you, hope you can be our customers

@ankur_jeswani It supports any software you can run on your desktop or the Virtual Machines we have, since it just uses a screen, mouse and keyboard.

@sevgiuurelukag Our VMs last forever, irrelevant of the tasks or the number of steps. And we specialize in long-horizon tasks(30m+), so we deal with this all the time.

@prateek_j1 given you started with prior auth and EHRs, the "every click and keystroke recorded so you can replay exactly what the agent did" part raises a real question for that use case specifically: those replays and screenshots would routinely contain PHI on screen. where does that action log live, who can access it, and what's the retention/deletion policy on it, since the audit trail itself becomes a second copy of sensitive patient data that needs the same protection as the source system

@omri_ben_shoham1 definitely made tradeoffs in some areas.

@vedat2091990 Hey we currently do cold starts, so wait times are longer, but watch out for updates :) we will make it superfast in upcoming times

@steven_snider We were horizontal haha. We’re still exploring which vertical to focus on but prior auth and healthcare was one of the first.

@amjad_shaik Not much setup is required! Just download the local version of Coasty and run it.

@kaanalayandvxb The VM spins up slow(about 2m) since it's an instance that lasts forever but we are working on making it even faster.

@irahimiam It keeps the state of the VM(doesn’t reset) and a snapshot when the VM fails for some reason, so you can restore and continue.

@sudhirr_vashist Congratulations on the launch!

What stood out to me is how you're changing the way people interact with SEO data. Instead of searching through reports, you can simply ask a question and get context-aware recommendations instantly.

The WhatsApp-first experience feels surprisingly natural, especially for quick decision-making. Wishing the SEORCE team all the very best—excited to see where this goes!

@senamelekavm8u Thanks for your question, All the changes suggested by the Autofix SLM go through an approval, nothing gets posted without your intervention or approvals. We work with some really large teams and websites and this comes about as a common concern. The good thing is that what took weeks now takes minutes to fix or optimise, with AI built in that learns your website and brand. Every fix compounds the learning.

@senamelekavm8u Great question... AutoFix SLM doesn’t just randomly change pages. It first looks at the crawl data, page context, technical issues, and ranking impact. Then it focuses on safe, clear fixes like schema, meta tags, alt text, headings, and canonicals. For anything that could affect existing rankings in a bigger way, it doesn’t blindly push changes. It prioritizes the issue, shows the context, and keeps the fix controlled so teams can act with confidence. So basically fix what is clearly broken, avoid unnecessary changes, and protect what is already working.

@jared_salois Many thanks for the appreciation and your conviction.

@jared_salois 

Thank you!

We see WhatsApp as the conversational interface, not the replacement for the dashboard.

The dashboard will remain the place for deeper analysis, visualisations, historical trends, configuration and taking actions.

WhatsApp is designed for speed-asking questions, getting instant insights, alerts, summaries and recommendations without having to log in every time.

Over time, we expect users to spend a lot more of their day-to-day interactions in chat, while the dashboard becomes the workspace for deeper investigation and execution. The two are designed to complement each other rather than compete.

@princeku945 Excited for this launch and looking forward to conversations. The idea was very simple, instead of bringing users to the platform, let us take @SEORCE where the users already are.

@galdayan Tricky one.

That's a fair concern, and we've designed it so it's not simply "whoever messages from this number gets the data."

Your WhatsApp number is linked to your SEORCE account and can only be managed from within your authenticated account on https://seorce.com. If you change your phone number, switch devices, or want to use a different WhatsApp number, you simply log in and update it under Account Settings.

In other words, the pairing is established through your authenticated SEORCE account - not by WhatsApp alone. The WhatsApp number is just the communication channel, while the account remains the source of authentication and access control.

@suryansh_tiwari2 Thanks much.

@amine_aziz_alaoui Dashboards have been replaced by AI and conversations. ChatGPT, Claude made this interface handy and usual. We decided to bring this to the communication platform that is used by businesses in general.

Thanks for your appreciation.

@sneas Thank you very much!

@i_love_my_india4 In a few geographies, businesses use Whatsapp as the primary communication platform, it was a natural extension for our AI Agent to be available and be closer to our users.

@benjamin_jorgensen1 Congrats on the launch, Ben! 🎉

What stood out to me wasn't just the security layer, but how Gate AI combines prompt injection defense, secret redaction, cost optimization, and an auditable blockchain trail into one workflow. Making onboarding simple enough for non-technical stakeholders is a smart move too.

Looking forward to seeing how engineering teams adopt this.

@benjamin_jorgensen1 Great Job!

@satanuurscfq The immutable audit trail is fully bundled in the Free tier (and every paid plan). No per-call costs, no usage limits, and no hidden fees for the core logging/verification itself.

@satanuurscfq The audit trail is bundled with the free tier. The audits leverage Constellation's Digital Evidence technology. In the future, we'll add more reporting features that may end up in paid tiers. The basic auditing will remain free.

Hello!

I'm a Mechanical Engineer from Japan, and I'm expanding my engineering business into the U.S. market. I'm looking for U.S. citizens interested in a long-term collaboration.

Could you help me with my business? Looking forward to connecting with you

Hello @gabriel_claramunt 

I'm a Mechanical Engineer from Japan, and I'm expanding my engineering business into the U.S. market. I'm looking for U.S. citizens interested in a long-term collaboration.

Could you help me with my business?

Looking forward to connecting with you

@crystalmei Good questions. Our published benchmarks measure against 16 public datasets covering both known injection/attack scenarios and benign prompts. We train against real agent attack scenarios as well but focused on datasets in the benchmarks that allow comparison against other systems. You can read more about the benchmark methodology on our blog post or read the arXiv report if you want to deep dive on the specifics.

The tokens savings come from a combination of inline prompt compression and response caching. Most workflows see 20-30% token savings from the compression alone. Response caching is configurable and more dependent on your workflow but can save a significant additional amount on repetitive workflows.

@amjad_shaik Honestly a bit of both, but the token savings tend to be the bigger draw right now - especially with Fable burning through tokens on Claude subscriptions so fast lately.

The prompt injection security is the harder feature for other platforms to match, and nearly all the current options are enterprise-only. We wanted something anyone could sign up for to protect their workflows without booking a sales call.

Overall we want the platform to be a place anyone running AI agents can plug into for visibility into what their agents are doing, protection against prompt injection and other attacks, and lower costs, without giving up the tools they're already using.

@galdayan Great question. The blockchain anchoring is an automated way to publish Merkle roots of your data to a public ledger. The advantage over a self-published chain is that the timestamp is fixed externally - we can prove the state of your data at each point in time and that it wasn't altered afterward, precisely because we don't control the anchor. A timestamp you set yourself doesn't prove anything, but one anchored to a public ledger does.

It arguably exceeds the standard that would be demanded by an auditor but we believe it is a more complete solution for tamper-evident logs. The cost is highly optimized and not really a factor - it's free for all account types.

@omri_ben_shoham1 The benchmarks were run by our team and we published the complete methodology so that anyone can replicate the results. You can check out the blog post or arXiv report if you want to dig into the specifics.

The prompt compression never changes prompt wording - it saves tokens by removing whitespace and invisible tokens, and reformatting inefficient or duplicate tool results. There are specific strategies for different tools that are designed to optimize for token count without modifying the information available to the model.

Hey@artstavenka1 !!!

Exactly, my friend. It's so nice to hear that, great that you got the idea :)

ps. I just tried to say exactly "12 quid lunch" and it have no issues😁 (ofc account is missing because we did not specified the account)

Hey @sergbmw! 👋

I'm really glad you caught the vibe and intention behind ARKAD 🖤

I think the biggest psychological decision we made was making ARKAD Aura feel less like a grade from a teacher and more like something that's alive, something you naturally want to take care of and improve.

The goal is to create just enough gentle pressure to encourage better financial habits while still feeling supportive.

Heeey @busmark_w_nika!

Haha, that's actually a very interesting question! 😄

The funny thing is... spreadsheets are kind of our sworn enemy. 😂 The whole idea behind ARKAD is to help people escape the world of endless Excel sheets and manual budgeting.

So instead of writing your expenses into a spreadsheet, we'd rather help you never need one again. 😉 Just talk to ARKAD, and let it handle the boring stuff for you.

(Although... if enough people ask for Excel export, we might have to make peace with our old enemy. 😅)

Thanks so much @raphael_kamm !

That honestly means a lot to hear. 🙌

That's exactly the kind of friction we wanted to remove. We're really happy the voice-first approach resonates with you, and we hope ARKAD becomes the budgeting app that you love 🖤

Thanks a lot, @leo404 ! Really glad the voice-first approach resonated with you! 🙌

At the moment, we don't import historical data. Bank statements or spreadsheets usually miss a lot of the context and relationships ARKAD builds over time, so they'd create an incomplete picture.

And yes - you can always export your data from ARKAD if you decide to leave.(ps. but it will not happen because ARKAD Wallet is addicting!!!) 😊

Thanks a lot ignacio_zorrilla_barbera! Really happy you like the UI! 🙌

We don't support data import just yet - we're working on bank integrations, so your recent transaction history will be imported automatically once you connect your bank.

As for export, we don't have an automatic option yet, but we're happy to prepare it manually if needed.

By the way, how would you expect import/export to work? We'd love to hear your thoughts! 😊

@vikramp7470 Actually like that idea a lot & it's exactly in line with the core thesis of the platform: not give you raw signals to process, but actual 'next steps'. At the moment we already 'surface the gaps & opportunities', for both AI search & regular Search Engines, but adding the next step after that would make a lot of sense (and it's not a heavy lift to build, we have most of it in place to do this quickly). Thanks for the tip!

@omri_ben_shoham1 What Glimpse does: we build a panel of 25 buyer-style prompts for your category (the questions a real evaluator would ask, "best X for Y", comparison questions, "alternatives to [incumbent]", problem-framed questions rather than brand-framed ones). We run that panel against the major models and AI search surfaces on a recurring schedule, then track three things over time: whether you're mentioned at all, where you sit relative to competitors, and what sources the answer cites.

The citation part matters most in practice, because it tells you which pages are feeding the answers, and that's the part you can actually act on.

The "before a deal exists" framing comes from that last piece: if the models consistently recommend your competitor for the exact question your ICP asks, you're losing evaluations you never knew were happening. No CRM will ever show you that loss.

Fair caveats: it's sampling, not a census. Model answers vary run to run, so we track trends and deltas rather than treating any single answer as ground truth. Point-in-time AI visibility scores are mostly noise; the movement is the signal.

@chielephant Short answer: ranked, not dumped. Glimpse separates raw signals from insights. Signals are everything we observe (and yes, that includes the blog posts and the button colors, the full stream is there if you ever want to dig). Insights are the layer you actually read: changes that cleared a materiality threshold against that competitor's own baseline, tagged by severity. A pricing page edit, an unusual spike in messaging changes, a repositioning pattern across several pages. The routine churn never reaches you.

Your one-incumbent case is actually where this works best. The baseline gets tight fast, so deviations stand out clearly. If your incumbent normally touches their site twice a week and suddenly rewrites their pricing and positioning pages, that's an alert in your inbox with the why attached, not item 47 in a feed.

And the rare-but-critical stuff you mentioned (pricing, repositioning) is exactly what the severity model weights highest, because you're right: missing one of those is the whole cost of doing this badly.

@mittalpatel Signal-vs-noise is honestly the whole product. Raw monitoring is easy; the hard part is not burying a sales team in it. Today Glimpse handles it in three layers:

1. Every competitor gets its own baseline. A pricing page change from a competitor that never touches pricing means something very different than one from a company that A/Bs it weekly. Insights only fire when activity clears a materiality threshold vs that competitor's own normal, so "20 page changes this week vs a typical 7" surfaces, routine churn doesn't.

2. Insights carry severity (alert / warning / info), so a team can decide where their attention floor sits. Most of the stream never needs to be read.

3. Teams can dismiss insights, and that feedback is the seed for the part you're really asking about: learning what matters to your team specifically. Full per-team relevance learning (this team cares about pricing and hiring, ignores social) is where we're headed rather than fully shipped today. I'd rather be honest about that than pretend the magic is done.

Battle cards are per-competitor and regenerate from live signals, so they're not treated the same in content, but the prioritization layer above them is what makes the difference between intel and noise.

@matthieu_poitrimolt That's exactly our thesis. ;-)

@amjad_shaik It's meant for ongoing monitoring, exactly to avoid that one-off research to become stale & outdated really quickly.

@dhiraj_patel5 We check twice a day for changes, which for something like a pricing page should be more than enough. :-)

@galdayan What I actually see is the incentive running the other way right now. Companies are making their pricing and positioning pages MORE bot-legible, not less, because LLM crawlers (ChatGPT, Perplexity, Claude) have become a real buyer discovery channel. If you cloak your pricing page against automated traffic, you're also cloaking it against the answer engines your prospects are asking. That trade is a bad one, so almost nobody makes it.

The "cloaking" that does exist is mostly the old-fashioned kind: sales-led companies hiding pricing behind "talk to sales." That predates CI tools by a decade and it's about deal-level price discrimination, not bots.

Decoy ad variants: haven't seen it in B2B SaaS. Ad libraries on Meta and LinkedIn are already public by regulation, so the cost of running fake variants (confusing your own performance data, wasting spend) outweighs fooling a competitor's dashboard.

On symmetry, I think you're right that it becomes table stakes, same as everyone having analytics. But detection was never really the moat. Everyone can see a competitor shipped a pricing change. Very few teams interpret it correctly and respond within the week instead of finding out from a lost deal three months later. That gap is where the value stays even when watching is symmetric.

@vincent_vandegans Thanks for the support & interesting idea, appreciated!

@andrasczeizel We have 25 prompts that we track across all major LLMs. We provide a list of suggested prompts based on your own website & the competitor's website, but you can also add your own! The AI visibility score allows you to track your progress over time.

@reda_roqai_chaoui Usually because we get the data straight from the original source: public ad libraries, competitor's website, social channels, etc.. So it actually parses the original raw data first, then we enrich it through our own engine & then convert it into analysis & recommended actions. So it's not a LLM wrapper that hallucinates random insights.

@daniela_pilla (at this stage) we don't compare on a feature-by-feature basis as such, but we do track 'new features' for example. And all of the other things like social presence & distribution channels is exactly what Glimpse does. We monitor both organic & paid channels and give you a full insight in which ads your competitors run, for how long, which USPs they use, etc..

@aliyazhanabayy Congratulations on the launch!

@aliyazhanabayy Wow, so useful!!

@artstavenka1 appreciate that, you nailed it. optimising for volume is exactly where they faceplant, the template starts showing and people smell it instantly. keeping it unsmellable is the actual hard part and pretty much the thing we obsess over here. thanks for getting it.

@elias_motionfy thank you for going straight at it. outloud learns from your reply history too, not just polished posts, and treats replies and posts as separate contexts so replies stay short and loose while posts keep their structure.

@german_merlo1 thanks so much Germán, appreciate you stopping by.

@amjad_shaik it trains on your existing posts, so the first drafts are usually already close instead of starting from zero. most people just tweak a couple of the early ones to sharpen it and it locks in fast from there, and the more you run through it the tighter the voice gets. and if you're starting fresh, you can pick a celebrity voice from the voice library in the platform and shape it into your own.

@nzhumasseiit thanks Nuray, really glad it stayed genuine for you, that's the whole point. autopilot publishes on its own on a schedule so you don't have to touch it. but if you'd rather eyeball things first, you can keep it in draft mode and approve each post before it goes out.

@madalina_barbu appreciate it Madalina, thank you!

@busmark_w_nika yeah! most common one: people expect it to read as ai and then it doesn't, it sounds like them. that plus early testers gave me an idea for autopilot that made it in.

@yerkonty appreciate this, glad it sounded like you.

on voice, it needs about 150 words of your writing to lock onto your style, so a couple of posts or one solid sample does it. the more you connect after that, the sharper it gets.

as for autopilot, you choose. the default is full review, so it drafts and you approve before anything posts. you can flip it fully hands-off if you want, but you're never locked in.

@yerkonty Thank you for your feedback🙌. About early startups, user can add additional context on profile page, as a result it still generates personalized posts.

In reddit and threads it generates different posts, since there are different algorithm.

@remg3bj Thank you for your feedback🙌. Appreciate it

@aryan787544 thank you🙏

@varun1jan Great question. The Blocks Network allows you to create an org, under which you register your agents. Each agent gets an API token for access to the network, and each task between agents generates and distributes its own auth token that rotates to each task.

Org --> agent (API Token) --> task (per-task tokens)

When a task is submitted by a "caller" agent, the Blocks Network checks whether the caller has permission, and if so, relays the task to "provider" agent, and relays the per-task tokens to both the provider and caller. From that point forward, the caller and provider communicate directly (proxied via PubNub streaming using the per-task tokens). Subsequent tasks require re-authorization and new token generation (all handled automatically by Blocks Network).

The bottom line is that identity is proven per request, and the Blocks Network itself is responsible for verifying the callers permissions and validating the tokens (which can be instantly revoked if an agent needs to removed from the network).

There's a good whitepaper with tons more detail here: https://blocks.ai/architecture/security-whitepaper

@adilhrel7rew Authentication is handled via OIDC PKCE with GitHub and Google. For secure handoffs and session data, we use CBOR Web Tokens (similar to JWTs but using CBOR instead of JSON). OIDC PKCE is how Auth0 and Better-auth provide authentication. This allows agents running in different frameworks to communicate securely with the blocks network communication layer.

@adilhrel7rew To add on to @stephenlb's response: The Blocks Network is responsible for authentication and identity on a per-agent basis. This doesn't bypass or invalidate any per-framework security, it just wraps it with the Blocks SDK.

The Blocks SDK works by establishing an outbound socket connection to the Blocks Network, managing the token distribution, listens for tasks that are dispatched via Blocks, and then hands them off to the local agent.

Comms-level security are handled through a set of data stream channel names (via PubNub), each with it's own permission level. For example, tasks are submitted through an inbound channel that only the Blocks Network can publish on (the caller agents cannot directly submit tasks on that channel). Data streaming outbound (from provider-to-caller) happens on channels that can only be written (i.e. published to) by the provider agent, and listened to (i.e. subscribed) by the caller agent.

The details on how that all works are in another whitepaper here: https://blocks.ai/architecture/network-whitepaper

@emirhan255440 Blocks is currently free for your project use. If you list your agents on the Blocks Network in "private/free" mode, only you and the people/agents you explicitly invite can access. If you list your agents in "public/paid" mode specify a per-task price, then your agents will be listed publicly on the Network tab (https://app.blocks.ai/agents) and Blocks takes 15% of the per-task revenue, you get 85%. (Note you can also list your agent as "private/paid" and Blocks takes 15% of the revenue, but your agent won't be listed in the Network tab.)

We will soon be launching an "enterprise" version that has a variety of compliance, auditing, added security, and other extensions that will have its own price tag.

@ali514664046464 Please see my comments on pricing above. Latency increase is generally not noticeable (especially for "pipe" tasks when you're communicating via pub/sub; that's generally adding ~20-30 ms over the WAN; your VPC can be ~5-10ms depending on physical distance, or even sometimes slower than Blocks-based latency since your VPC may extend across multiple data centers, firewalls, etc as well). Plus, there are other benefits within Blocks that make latency even lower:

• Automatic compression and bundling of messages over configurable time windows.

• Automatic least-loaded load balancing across multiple instances of an agent based on concurrent tasks/instance.

• JWT-style signed tokens that auth in microseconds on a per-message basis.

For inference-based agents, 99+% of the latency will be within your agent as it does inference. For faster, deteministic agents that need low-latency streams and low-latency responses, Blocks is fast enough to route voice in real-time, stream video, etc, send telemetry and control signals fast enough to "feel" local with no perceived latency difference.

@drichardsGiving AI agents a full sales stack — lead gen, enrichment, research and LinkedIn outreach across 300M profiles — is the missing half most agent projects hit a wall on, and bundling it behind one interface is what makes it usable instead of a pile of integrations.

That kind of workflow lands harder when people watch it run than when they read about it, and you launched without a demo — so I made you one, free and whitelabel, no string and you can add it to your launch page medias:

https://www.youtube.com/watch?v=B91ZPY1CW5o

Yours to keep — download it from https://foxplug.com/v/ss-sales-stack-a-full-sales-sta-52ce8dc7 and put it on your own channel or launch page. Launches with a video do better, and yours is still editable. Made at https://foxplug.com/?utm_source=producthunt&utm_medium=comment — make more there, or record your own product tour in ~2 minutes. Anyone else launching soon: paste your site, video in about 30 seconds. Nice launch.

@shubhransh_srivastav Really appreciate the feedback.
Pro tip – Switch on updates and stay up-to-date about all your investments.

Happy investing :)

@aditya_bhattacharyya Thanks, Aditya, for the kind words! This is just the start. There is a lot more in the pipeline yet to come. Onwards and upwards !!

@amjad_shaik At the moment, Only publicly available information.

@arinburtakpq70 Thanks, Arin! Our aim is to give full visibility to investors as they deploy their precious capital.

@naman_shukla Trust through transparency was one of the key pillars when we embarked on developing this product.
And yes – it's dynamically updated in real time with the latest filing we receive. It checks the recency as well as the document type before updating the thesis. Not all documents are the same.

p.s. You'd be surprised how often a company changes their EPS value in the financial results & then in the subsequent press release. :p