A runtime for tools, credentials, and sessions
Dexby sits between an agent framework and the APIs it needs to reach. It owns the parts that are tedious to build once and dangerous to build twice: whose credential this is, whether it may be used, and what has to be recorded afterwards.
What the runtime owns
Session isolation
A session binds one user identity before any tool is exported. Direct execution demands that identity on the call. There is no path through the runtime that executes a tool without knowing who it is acting for.
Credential resolution
Tokens are hydrated inside the runtime at execution time and discarded when the call ends. Refresh, rotation, and revocation are handled once, centrally, rather than reimplemented per service.
Envelope encryption
Records are encrypted before they are written. AWS KMS with AES-256-GCM in cloud, local SDK keyrings on self-host. PostgreSQL and DynamoDB are configured independently of one another.
Typed tools
Connectors declare Zod input and output schemas, the OAuth scopes a tool requires, whether it reads or writes, and how its payload is classified. Invalid arguments never reach the upstream API.
Framework adapters
Dedicated providers for Vercel AI SDK, Mastra, and OpenAI function calling. Each returns tool definitions in that framework’s own shape with an executor already bound to the session user.
HTTP API
Authenticated sessions or API keys, with routes for tools, connectors, connections, and sessions. The TypeScript SDK is a client over that API rather than a second runtime that can drift from it.
A tool declares its own blast radius
Governance is a property of the definition rather than a convention in a runbook. Every tool in every connector carries the same fields, so a reviewer reads one shape no matter who wrote the integration.
| Field | Example | What it controls |
|---|---|---|
| id | slack_post_message | Stable identifier the model calls and the audit record stores |
| effect | write | read, write, or destructive. Lets you export read-only tool sets |
| requiredScopes | ['chat:write'] | Checked against the granted scopes before execution, failing closed |
| dataClassification | pii | Drives redaction in logs, traces, and metrics |
| inputSchema | ZodObject | Validated before the call, and exported as JSON Schema to the model |
| outputSchema | ZodObject | Validated on the way back, so a changed upstream shape surfaces as an error |
Because effect and classification are declared, a session can export only read tools to an untrusted agent, and telemetry can redact a PII field without the connector author writing any logging code.
Connectors, and an escape hatch when there is none
A connector is a client plus typed tools. Until an endpoint is modelled, a stored credential can still reach it through an authenticated proxy, keeping the same encryption and audit path instead of forcing a plaintext token into your code.
Two targets, one contract
Dexby Cloud runs on AWS with KMS-backed keys and warm Fargate runtimes. Self-hosting is Docker Compose with PostgreSQL and local keyrings, with no proprietary cloud API in the path. Every backend component is built to run in both, so choosing one is not a one-way door.