Skip to content
anvil

What Anvil is

Anvil is a compiler for agent tools. Point it at an API spec you already have, and it produces four things that stay in sync: a CLI, an MCP server, an agent skill, and enforcement hooks. All four are built from one shared model — AIR, the Anvil Intermediate Representation — so they can’t disagree about what an operation does or whether it’s safe to run.

The problem it solves

Section titled “The problem it solves”

Wire an agent to an API by hand and the agent has to guess: what does this endpoint do, is it safe to retry, will it charge a card twice, does it need confirmation? Those answers live in a person’s head, not in the tool. And when the same API becomes a CLI, an MCP server, and a skill, the three copies drift apart as the API changes — so the agent guesses differently on each.

Anvil removes the guessing. It builds one model of every operation — what it does (read or mutation), how risky it is, whether it can be undone, whether it’s safe to repeat, and whether it needs confirmation — and generates every tool from that one model. The result: the agent stops guessing.

What it compiles

Section titled “What it compiles”

Every format lands in the same shared model and the same aligned outputs:

  • OpenAPI 3.x
  • Swagger 2.0
  • Google Discovery
  • GraphQL SDL
  • gRPC / proto3 (multi-file)
  • SOAP / WSDL (multi-file)
  • Postman Collections

When the API lives behind a gateway, Anvil can assess its estate, but the accepted bytes differ by vendor. WSO2 apictl collections are native estate input; Kong accepts one native declarative state file. Apigee, MuleSoft, and IBM API Connect currently require Anvil’s documented normalized interchange—native proxy bundles, Mule JARs, and x-ibm-configuration are not decoded. Run anvil estate support --json for the versioned input, semantic, authority, fixture, and scale-proof contract before preparing a capture. Read the exact boundaries →

What it produces

Section titled “What it produces”
  • CLI — a typed command per approved operation.
  • MCP server — the same operations as MCP tools, risk visible in tool metadata.
  • Skill — a progressive-disclosure operating manual for agents.
  • Enforcement hooks — installable Antigravity, Claude Code, and Codex hooks that refuse unsafe calls before the model burns a turn.
who is calling Human at a terminal engineers · CI pipelines · scripts Agent in a harness Antigravity · Claude Code · Codex Platform team enforcing policy across every agent runs reads calls installs CLI typed commands · --dry-run scriptable in CI Skill the operating manual capabilities → workflows MCP server one tool per approved op risk visible in annotations Harness hooks Antigravity · Claude Code · Codex deny pre-flight · escalate AIR one model — every tool agrees
fig 05 · pick any entry point — they all land on the same contract

Which tool you use depends only on who’s calling: people and CI script the CLI, an agent in a harness reads the skill and calls the MCP server, and a platform team installs the hooks. All four are generated from the same model and regenerated together — so they can’t disagree.

The safety contract

Section titled “The safety contract”
  • Only approved operations are exposed by the generated tools.
  • Mutations that can’t be safely repeated are never retried automatically and require --confirm.
  • Unsafe operations get the missing facts filled in with a manifest — a small YAML file where you add what the spec left out — rather than being approved blindly.
  • Secrets are never logged; the runtime redacts auth material from records.

Every operation moves through a fixed set of states before an agent can call it: it starts generated, waits at review_required until a person reads its risk, and only then becomes approved.

an operation's approval lifecycle after compile held for review a human decides the agent Generated state: generated risky · non-idempotent Review required held for review human approves Approved state: approved compiled MCP tool the agent can call it rejected Blocked never ships to an agent later Deprecated the spec dropped it only approved operations are compiled into a tool — everything else is invisible to the agent.
fig 07 · nothing reaches an agent until a human moves it to approved

Read Operating Anvil for the day-to-day loop, or the Quickstart to build your first bundle.