# Graft Docs

> Graft makes the agent you already run self-extending: ask it for something it has no tool for, and Graft writes that tool, tests it against the real service, and hands it over. It is expressed as an MCP server.

Every page below is available as plain markdown at the linked `.md` address; the same path without `.md` is the HTML page. The whole set in one file: https://docs.getgraft.ai/llms-full.txt. The source of truth for the product is the open repository, https://github.com/getmodern-ai/graft, whose README carries the self-hosting walkthrough.

## Get started

- [What is Graft](https://docs.getgraft.ai/graft/get-started/what-is-graft.md): Graft makes the agent you already run self-extending: ask it for something it has no tool for, and Graft writes that tool, tests it against the real service, and hands it over. It is expressed as an MCP server.
- [Quickstart](https://docs.getgraft.ai/graft/get-started/quickstart.md): From a Graft account to the first tool built for your agent, in under ten minutes, with Claude, ChatGPT, Hermes or OpenClaw.
- [Sign in and your first agent](https://docs.getgraft.ai/graft/get-started/sign-in-and-your-first-agent.md): Open the console, create an agent, and connect a harness with the token it shows you once.

## Core concepts

- [Agents and persons](https://docs.getgraft.ai/graft/concepts/agents-and-persons.md): You own the connections and the toolbox. Each harness that connects is an agent with its own token, scope and working set.
- [Connections and scope](https://docs.getgraft.ai/graft/concepts/connections-and-scope.md): A connection is one vendor account given to Graft: scheme, credential and host set. Scope is the connections an agent may use.
- [Tools and the toolbox](https://docs.getgraft.ai/graft/concepts/tools-and-the-toolbox.md): Meta-tools, authored tools, and the toolbox that keeps every version of every tool Graft's model has written for you.
- [The working set](https://docs.getgraft.ai/graft/concepts/the-working-set.md): The authored tools promoted for one agent are exactly what its harness sees. A cap and an idle window keep the set from becoming the kitchen sink.
- [Acquire](https://docs.getgraft.ai/graft/concepts/acquire.md): The job in which Graft's model reads a vendor's documentation, writes a tool, proves it without changing anything, publishes it and promotes it.
- [The proxy and sandboxes](https://docs.getgraft.ai/graft/concepts/the-proxy-and-sandboxes.md): Authored code runs in a sandbox whose only route out is the proxy, and the proxy is the only thing that ever holds your credential.

## Harnesses

- [Claude and ChatGPT](https://docs.getgraft.ai/graft/harnesses/claude-and-chatgpt.md): Add Graft to Claude.ai or ChatGPT as a custom connector with one URL. The product finds Graft's sign-in, you consent once in the console, and the consent creates the agent the connection will be.
- [Hermes](https://docs.getgraft.ai/graft/harnesses/hermes.md): Point Hermes at Graft with one mcp_servers entry and a token in .env, and know what its approval card means; the thin skill is optional.
- [OpenClaw](https://docs.getgraft.ai/graft/harnesses/openclaw.md): Point OpenClaw at Graft with an mcp.servers entry and a token in its .env, and answer approvals on the small page each link opens, since OpenClaw shows no buttons.
- [Any MCP client](https://docs.getgraft.ai/graft/harnesses/any-mcp-client.md): What a client needs to speak to Graft: streamable HTTP and one of two ways to say which agent it is, a static bearer header or MCP OAuth; what its model is told in the handshake when no skill is installed; and what the Hermes skill adds on top.

## Connections

- [Connecting a vendor](https://docs.getgraft.ai/graft/connections/connecting-a-vendor.md): The agent proposes the connection, you confirm it and enter the secret in the console. What the form shows, what it refuses, and what happens next.
- [OAuth with your own client](https://docs.getgraft.ai/graft/connections/oauth-with-your-own-client.md): For vendors that issue tokens through a consent rather than a key, Graft runs the flow against a client you register. The agent guides, the console takes the secret.
- [Managing and revoking](https://docs.getgraft.ai/graft/connections/managing-and-revoking.md): What the Connections screen shows, how to rotate a credential without touching approvals, and what revoking a connection does across every agent.

## Approvals

- [How approvals work](https://docs.getgraft.ai/graft/approvals/how-approvals-work.md): Reads never ask. Any other tool asks once and the answer holds, a destructive tool included. Asking every time is your opt-in per tool. Acquire asks once per agent per connection.
- [Answering in your harness](https://docs.getgraft.ai/graft/approvals/answering-in-your-harness.md): Hermes renders Graft's ask as its own Allow/Deny card. OpenClaw shows no buttons, so the answer goes through the console.
- [Answering in the console](https://docs.getgraft.ai/graft/approvals/answering-in-the-console.md): Pending actions is where every ask your agents could not settle waits for you: a write's first call, a destructive call, a build, a connection, a credential.

## The toolbox

- [Promote and demote](https://docs.getgraft.ai/graft/toolbox/promote-and-demote.md): How a tool moves in and out of an agent's working set: by the agent's own call, and by the cap and idle rule that keeps the list from growing without end.
- [Reading a tool's source](https://docs.getgraft.ai/graft/toolbox/reading-a-tools-source.md): Every authored tool is a small module you can read: what it calls, with which method, and why it holds neither a credential nor a host.
- [Packages and SDKs](https://docs.getgraft.ai/graft/toolbox/packages-and-sdks.md): Hand-written calls through ctx.fetch are the default. When Graft's model reaches for a vendor SDK, the SDK is bound to the proxy and the package must clear the package policy.

## The console

- [Agents](https://docs.getgraft.ai/graft/console/agents.md): The Agents screen: create an agent and get its token once, set its scope, cap and idle window, and read its working set, approvals and history.
- [Pending actions](https://docs.getgraft.ai/graft/console/pending-actions.md): Where an agent's asks land when it cannot settle them itself: a tool's first call, every call of a tool set to ask every time, a build against a connection, a connection to set up or a credential to re-enter.
- [Settings and model keys](https://docs.getgraft.ai/graft/console/settings-and-model-keys.md): The Settings screen holds what is yours across every agent: the model your acquire jobs run on, set by bringing your own provider key.

## Self-hosting

- [Run Graft with Docker Compose](https://docs.getgraft.ai/graft/self-hosting/docker-compose.md): Ten minutes from a machine with Docker to an agent that acquires its own tools, using the compose file in the Graft repository.
- [Configuration](https://docs.getgraft.ai/graft/self-hosting/configuration.md): Every GRAFT_* variable the self-hosted server reads, its default, and when Graft refuses to start without it.
- [Route vendors through your API gateway](https://docs.getgraft.ai/graft/self-hosting/route-vendors-through-your-api-gateway.md): Point self-hosted Graft at the API gateway your company already runs. Vendors behind it connect with no person step, and every call relays through the gateway with your deployment's identity attached.
- [Upgrading](https://docs.getgraft.ai/graft/self-hosting/upgrading.md): Pull the new image and restart; migrations run on start. What survives, what only down -v removes, and how to pin a release.

## Graft Cloud

- [Graft Cloud](https://docs.getgraft.ai/graft/cloud/overview.md): The hosted form of Graft, with its console at app.getgraft.ai: the same loop, console and rules as the Docker image, with Graft running the sandboxes, the keyring and the authoring model.
- [Bring your own model key](https://docs.getgraft.ai/graft/cloud/bring-your-own-model-key.md): Run your acquire jobs on your own Anthropic or OpenAI key instead of Graft's fixed model, from the Settings screen.

## Security

- [How credentials are protected](https://docs.getgraft.ai/graft/security/how-credentials-are-protected.md): A vendor credential is entered once in the console, decrypted in one component, and never enters a sandbox, a tool's code or a model. What holds that line, step by step.
- [What the model can and cannot do](https://docs.getgraft.ai/graft/security/what-the-model-can-and-cannot-do.md): Two models take part in acquiring a tool. What Graft's model is given and refused, what the agent's model can call, and what only you can do.

## Help

- [FAQ](https://docs.getgraft.ai/graft/faq.md): Short answers to the questions people ask about Graft: what it is and is not, where secrets go, why a tool asked or did not, and what happens on the machine.