Blog
What we learn building covey: how the platform works, why it is built this way, and what proves itself in practice when AI agents are managed like employees.
How do you manage AI agents from a script?
An API key lets scripts and pipelines call the covey API. What it may do, what only the browser can do, and how rotation and revocation work.
How does an AI agent find a project's conventions?
An agent runs in its home while CLAUDE.md sits in the checkout. The sub-run starts inside the project and pays for it with executable repo content.
Which machine does an AI agent run on?
Every sandbox starts through a runner, even on a single machine. How covey picks the host, what tags exclude, and what a runner has to see to start one.
How do you connect your own system to an AI agent?
Connecting a system with no ready-made plugin: four plugin kinds, three of them installable at runtime, and why a manifest cannot name a host.
Can an AI agent have a mailbox of its own?
An agent reads a mailbox of its own by IMAP and answers by SMTP. This post names the two secrets, the intake by heartbeat, and the send allowlist.
What data leaves a self-hosted covey installation?
covey sends counts to the project once a day. This post lists the thirteen fields, the test that catches everything else, and the three switches.
How do you stop every AI agent at once?
covey has two switches: one per agent and one per organisation. Both set a flag, abort the running session and put the started task back into the backlog.
How do you cap what an AI agent spends?
covey books an agent's cost after every run and checks it against a per-agent cap. When it is reached the agent is paused and its running task goes back into the backlog.
What does an agent's heartbeat do when nobody is watching?
A line in HEARTBEAT.md, a tick every 30 seconds and a condition that asks the target system first: how a scheduled agent runs, and where it stops.
What happens to the work when the sandbox is lost?
A sandbox is deliberately dumb and replaceable, the home survives it. After every job it goes into a content-addressed store as a whole — with no list of what is valuable.
How does an AI agent remember what it learned?
An agent's memory is linked Markdown pages, one per thing — not diary entries about single cases. How filing, search and clean-up fit together.
How do you run Claude Code on a server without sitting in front of it?
Claude Code goes headless with one flag. What a server run needs beyond it: a key outside the container, a session that waits, and limits on the call itself.
Why don't an agent's limits live in its prompt?
A rule in SOUL.md binds the agent through the prompt. A guard rail sits at the broker, the action layer and the approval queue, fail-closed.
Why does an agent never see its own credentials?
How covey brokers access to target systems at runtime: short-lived, scoped tokens that never sit in the sandbox as long-lived secrets.
How do you control what an AI agent can reach on the network?
How covey uses a proxy allowlist and hard network isolation to control what an agent sandbox can reach.
The website and the product are two things now
Why publishing a blog post used to mean deploying the platform, what that had to do with self-hosters, and what we built instead.
How do you isolate an AI agent that runs code?
Every agent gets an isolated working environment of its own. How it is built, what survives a restart, and how it is spread across servers you run yourself.
How does an AI agent get access to GitLab, Jira and Zammad?
An agent is meant to work in Zammad, GitLab or Kubernetes. How it gets in, who holds the credentials, and why they never sit in its working environment.
An agent that proposes and changes nothing
Covey Doctor reviews the other agents and the platform itself. Why it may not change anything, and why an approval records the exact values a person read.
How do you measure what an AI agent got done?
No model awards a grade here. We count verifiable events instead. Why we chose that, and why an agent never gets to see the rule it is measured by.