acquire loop, the same console, the same proxy and the same rules about who is asked and when. What differs is what stands behind three seams. Authored code runs in Blaxel sandboxes rather than Docker containers on your machine; credentials are encrypted by a KMS-backed keyring rather than a key derived from a secret in your .env; and published tools are mirrored to S3. Graft’s model authors on Graft’s account, and you may bring your own provider key instead.
Graft Cloud is free for a limited time during the alpha. Paid plans, when they come, will be priced per tool built, never per call your agent makes.
Everything a person does is identical in both forms. You sign in to the console, create an agent, paste its block into your harness, and your agent acquires tools against connections whose secrets you entered in the console. Reads pass, every other tool asks once and the answer holds, and you can set any tool to ask every time. The working set contracts by the same cap and idle rule.
One thing Graft Cloud adds is a second way to connect a vendor. For the vendors Pipedream Connect offers, Gmail first, you connect with one click instead of registering an OAuth client: the card has one button, you sign in to the vendor on Pipedream’s page, and you are back. The vendor’s token stays with Pipedream and never reaches Graft; every call for that connection is relayed through Pipedream’s proxy, which adds the token on the way to the vendor. Graft keeps only the account’s id. See Connecting a vendor.
Getting in
Open the console and Create an account: a name, an email and a password of at least eight characters. One account owns your connections and your toolbox, however many agents you run. Then Agents → New agent, copy the token once, and paste themcpServers block the console shows into your harness. It points at Graft Cloud’s /mcp endpoint and reads ${GRAFT_TOKEN} from your harness’s environment. From there, Sign in and your first agent is the same walk in either form.
What Graft runs for you
The security properties do not move between the columns. In both forms a credential is entered by you and never through the agent, decrypted only in the proxy, and never enters a sandbox, a tool’s code or a model’s context; a sandbox’s only egress is the proxy; and the proxy pins every request to the connection’s declared hosts. A connection made through Pipedream keeps the same line from the other side: the token never enters Graft at all. How credentials are protected applies to both.
The model and your data
In Graft Cloud,acquire runs on one strong coding model Graft chooses, with a cheaper model for triage, both on Graft’s account. So the vendor documentation Graft’s model reads, and the responses to its dry-run reads, pass through Graft’s model provider while a tool is being authored. If you would rather they went to a provider of your own, set a key under Settings; your jobs then run on your provider and nobody else’s. See Bring your own model key.
The self-hosted form always brings its own key, so nothing there passes through Graft’s provider at all.
Where next
Bring your own model key
Route your acquire jobs through your own Anthropic or OpenAI key.
Self-hosting with Docker Compose
The other form, on your own machine.