Your agent grows the tools it needs. Ask Claude, ChatGPT, Hermes, OpenClaw or any agent that speaks MCP for something it has no tool for, and Graft writes a small tool that does exactly that, tests it against the real service without changing anything, and hands it to the agent. Your credential never enters the tool’s code, the sandbox it runs in or any model. When the agent stops using the tool, it leaves the list again. Graft installs nothing in your agent: it runs beside it, over MCP. That makes the agent you already run self-extending, and the idea has research behind it. A harness is everything around the model that makes it an agent: the instructions, the available tools, memory and state. Recent work shows it need not stay fixed. In Self-Harness (Zhang et al., Shanghai Artificial Intelligence Laboratory, 2026), one model edits its own harness in a loop and keeps each change that improves it, and every model and benchmark they tried got better, with relative gains of up to 132%. Graft takes one of those surfaces, the tools, and grows it while your agent works. When a task needs a call no tool covers, the agent asks Graft to acquire one: Graft’s model reads the vendor’s documentation, writes the smallest module that makes the call, checks it, proves it against the live API without changing anything, publishes it, and promotes it into that agent’s tool list. Graft’s loop is narrower than the paper’s: it acquires at the moment of need and proves each tool with a dry run before it lands, rather than mining failures across a benchmark. All of this is expressed as an MCP server. You run the harness; Graft runs beside it, over MCP, as a handful of meta-tools plus exactly the tools currently promoted for that agent.

​
What Graft is not

  • Not a catalog. There is no pre-built integration library and no broker behind it. Graft’s model does the research, per person, per need, by reading the vendor’s documentation at acquire time.
  • Not a gateway. Graft does not sit in front of your other MCP servers and does not expose every tool of every app. An MCP server, like a REST API, is one more source the agent may carve a slice from.
  • Not a harness. It extends the one you already run, Claude, ChatGPT, Hermes or OpenClaw, and installs nothing there. A chat product learns when to call acquire from the MCP handshake itself; Hermes can take a thin skill that says the same.

​
The words

A person holds the account. You own your connections and your toolbox, however many harnesses you run. An agent is one harness connection to Graft, with a token of its own, a scope (the connections it may use) and a working set (the authored tools currently promoted for it). Hermes on your laptop and OpenClaw on a server are two agents over one toolbox. A connection is one vendor account you have given Graft: its auth scheme, its credential and the set of hosts it may reach. Credentials are write-only after entry and are typed only on Graft’s own form, never in chat. A tool is one capability the harness sees as an MCP tool. Everything in an agent’s list is either a meta-tool (acquire, acquire_status, find_tool, promote, demote, run_tool, request_connection, request_credential, and a low-level authoring set) or an authored tool, which Graft’s model wrote and which appears on the wire as <vendor>__<name>. The toolbox is your store of authored tools, every version kept. Nothing in it is ever deleted by the system: a demoted tool leaves an agent’s working set and stays in the toolbox, one find_tool and one promote away.

​
What happens when you ask for something new

  1. Your agent calls find_tool. A tool may already exist and be demoted.
  2. If the vendor is not connected, the agent calls request_connection and hands you a link into the console. The form arrives pre-filled with everything the agent proposed, lists every host the credential will be sent to, and takes the secret from you there.
  3. The agent calls acquire. Before Graft’s model runs anything against the connection, you approve once per agent per connection.
  4. acquire returns a job at once. The agent polls acquire_status, relays progress in a sentence when it changes, and the tool lands in its list when the dry run passes.
  5. The agent calls the new tool for your actual request. A read-only tool passes silently. Any other tool asks you once, destructive included, and the answer holds. If you would rather be asked before each call of a tool, turn on Ask every time for it in the console.

​
Two forms, one core

Graft Cloud is the hosted form, with its console at https://app.getgraft.ai. It authors with a fixed model Graft chooses, and you can bring your own model key in Settings to route your jobs through your provider instead. Self-hosted Graft is a Docker image and a compose file. It runs the same loop with a Docker sandbox, a local keyring and a filesystem toolbox, and it requires your own model provider key to start.

Quickstart

From a Graft account to your first acquired tool, in under ten minutes.

Acquire

What the job does, step by step, and what it reports while it runs.

How approvals work

Reads pass, everything else asks once, and asking every time is your opt-in.

Self-hosting with Docker Compose

Run the whole loop on your own machine.