Demos — the promises, proven
Each demo here proves a promise AgentStack makes — import once and render everywhere, undo byte-for-byte, and, deeper in, refuse an undeclared tool call and block an unapproved destination. Note the shape of that last one: AgentStack restricts destinations and records decisions. It does not inspect payloads, so an agent can still send data through a host you approved — see the claim discipline. Everything comes from examples/ in the repo: self-contained, self-asserting scripts that run in an isolated temp HOME, print PASS/FAIL per claim, and exit nonzero on any mismatch. Looking for how to use the CLI instead? That’s the how-to guides and the command reference.
first-value-demo
the core promise, proven
Two real native configs — Claude Code knows a github server (inline token), Codex knows tldraw, neither knows the other's. One
agentstack init imports both into one manifest (the token lifted to ${GITHUB_TOKEN} in a gitignored .env), one apply --write renders both native formats, doctor closes at 0 errors, and two restore --last --write return the machine byte-for-byte to where it started. Eight assertions, all green in the run replayed below.
examples/first-value-demo/run-demo.sh · DEMO_PAUSE=2.5 paces it for a recordingeveryday-loop-demo
the loop after the import, proven
Where first-value proves the import, this proves the loop you live in afterwards — the five verbs added in v0.18.0, across two isolated machines. A skill folder is dropped into
.agentstack/skills/ and activated: declared, pinned in the lock, and readable at .claude/skills/ where the CLI actually looks. Then undo --to 1 --write returns .mcp.json byte-for-byte — hand-written server and all — while leaving the dropped file alone. share writes a signed .astack bundle; on a second machine with its own trust store, receive stages it inert (its manifest is deliberately not merged) and up verifies against the lock and renders that machine's config. Twenty assertions, every one an on-disk effect rather than a command's own summary line.One honesty note the script encodes rather than hides:
agentstack yes is deliberately terminal-only — --yes answers its prompt but is no substitute for the review a human reads. The demo asserts that refusal, then runs the explicit adopt → lock → trust → use path the error message itself names.examples/everyday-loop-demo/run-demo.sh · needs python3 · DEMO_PAUSE=2.5 paces it for a recordingmalicious-repo-demo
the threat, proven
The ten-second proof of the gateway boundary. The villain is
evil_server.py: an MCP server advertising a friendly status tool and a malicious exfiltrate tool that reads a planted credential and POSTs it to a localhost sink. Tellingly, its manifest declares no firewall of its own — a malicious repo won't constrain itself. The same hostile repo runs three ways:
examples/malicious-repo-demo/run-demo.sh · needs python3 · DEMO_PAUSE=2.5 paces it for a recordingguard-demo
guard, asserted
Guard wires a cooperative pre-tool-use hook into the CLIs that support one (Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot CLI, Antigravity, OpenCode, Pi). Before a tool runs, the pending call goes to
guard check; every denial is recorded to ~/.agentstack/audit/calls.jsonl. Hand it a pending call:examples/guard-demo/run-demo.sh · finishes by grepping the audit log to prove the denials landedone-manifest-demo
portability wedge
The committed manifest declares one stdio server, one portable instruction fragment, and holds only
${GITHUB_TOKEN} — the demo greps it to prove it's secret-free before rendering anything. Then apply fans it out. Pick a CLI to see its native shape:examples/one-manifest-demo/run-demo.shsandbox · first run
the clean adoption story
demo-firstrun.sh builds a throwaway HOME each run, so it is always a genuine first run — a dev who already runs Claude Code with one MCP server, adopting agentstack to spread it across every other CLI. Step through it:sandbox · central library
by name, not by copy
central-demo/ is just a manifest — a toolset referencing a server + skill by name, no inline definitions, no capability files. Both resolve from the central library at ~/.agentstack/lib/. Walk the flow:sandbox · lockdown
no direct route — needs Docker
demo-lockdown.sh launches a real run --sandbox --lockdown container and then tries to get out of it. Click each attempt:The container sits on an internal-only network whose sole peer is the egress sidecar — posture
LOCKDOWN / ENFORCED · NO DIRECT ROUTE. Point AGENTSTACK_SANDBOX_IMAGE at an image carrying your CLI; the sidecar is pulled from GHCR, pinned per release.mcp-profile-lease
the zero-file workflow, proven
One real
agentstack mcp stdio process: the agent opens the backend toolset, loads its skill, freezes what it observed into a new toolset, and closes — asserting that none of the native artifacts (.mcp.json, .claude/skills/, sessions.json) were ever created. Step through the lifecycle — these are MCP tool calls, not shell commands:Machine-policy presets
Four ready-to-use standing firewalls — each a complete machine manifest, validated by the CLI's own loader in CI. Copy one to
~/.agentstack/agentstack.toml, then doctor. Pick one to see its stance:All four read as restrictive in doctor because each carries at least one rename-proof
"*" rule — it binds every server whatever a manifest calls it. Plain globs allow, a ! prefix denies; any allow pattern turns the list into an allowlist. A later broken edit runs DEGRADED on the last-known-good snapshot; broken first-run state is BLOCKED, never project-only.Seven example projects
Fake-but-realistic projects, each exercising one use case end-to-end with an assert.sh that proves it. Click one for the full story:
The dogfooding report these projects produced — the skill-indexing investigation, the CLI-differences matrix, the device test of run --locked — lives in examples/projects/FINDINGS.md.