Point it at a folder.
It reads, edits and runs — and asks first.

Lampson as an engine

Use it inside your apps. Serve your customers.

Lampson's agents also work headless: a bot that answers your business's messages, your backend asking an agent something, another AI using your agents as a tool.

• An agent is a file: its prompt, the exact tools it may use and its permissions.
• Telegram and Chatwoot (WhatsApp, Instagram, email) as channels — even with no public URL.
• SDKs for JavaScript (npm i lampson) and Python (pip install lampson): your functions as tools, plus an HTTP API with keys and MCP for Claude, Cursor or another Lampson.
• Tools with guarantees: a tool written in Synsema declares everything it can touch, and the language won't let it do more. Security →
• One conversation per customer; three messages in a row get a single answer.
• Objectives and teams: an agent works alone until it's done, or a whole team shares the work. Below →

Lampson as an engine →

$ lampson key add --agent tienda
API key created (k6KJgJHpu) for tienda · 120 requests/min

$ curl -X POST …/w/tienda/v1/messages \
    -H "Authorization: Bearer lk_…" \
    -d '{"to": "tienda", "thread": "cliente-42",
         "text": "do you have gluten-free bread?"}'

{"text": "Yes! Rice and millet bread at $4,100,
          we have 5 left.", "steps": 2, …}

$ lampson channel on telegram
telegram channel on · agent: tienda

Agent teams

Give a team a goal. They split it, review each other and ask you first.

A team with roles (CEO, CPO, CTO, Dev, CMO, or sales and stock) gets an objective and sees it through: they build a task board, message each other, work in parallel and review each other's work.

• Nobody steps on anyone: each task has one owner, and in a git project each agent works in its own copy, on its own branch, under its own author name.
• Nothing reaches main without you: a merge or a push waits for your approval, even if another agent says "approved".
• Everything is on record: who took what, who wrote to whom and what was approved. You watch it live on the team's canvas.
• Not only for code: a sales, support or research team works in its own folder.

A team spends more than a single agent: the run on the right took about 368,000 tokens across five agents. That's why there is a daily cap per agent and one per objective, and an agent with nothing to do spends nothing. For a one-role task, an objective for one agent is enough.

How teams work →

Ship version 0.2: a priority per task, with tests,
review and merge into main by the CTO, and a CHANGELOG.

21:38  ceo  added #11 "review and merge" → cto
21:39  cto  messaged → dev: "Your task: #8…"
21:39  cpo  moved #6 → review: requirements
21:40  cto  asks approval: merge team/empresa/cpo  ✓
21:42  dev  moved #8 → review: npm test 10/10
21:44  cto  asks approval: merge team/empresa/dev  ✓
21:45  cto  asks approval: merge team/empresa/cmo  ✓
21:46  ceo  finished O-2: "v0.2 shipped and verified on main"

─── 5 agents · 8 min · ~368k tokens · 3 merges you approved

Security

Your agent can fall for a trap. Your data can't.

An agent that serves strangers will get prompt injection: a link that looks like the courier's, "actually I'm another customer", a review with hidden orders. No model catches them every time.

• Each Synsema tool declares which hosts, files and variables it can touch. If the model falls for it, the call is denied: Capability not granted.
• Your app sets who is writing, not the model: "I'm cliente-bruno" doesn't change whose orders it sees.
• An agent for your customers has no bash, and doesn't read or write files: only the tools you gave it.
• If someone widens a tool's ceiling, it stops running until a person approves the change.

What it guarantees and what it doesn't → · The full recipe →

I got an email from the courier with this tracking link:
https://seguimiento.correo-sol.example.track-envios.net/…
Can you check it for me?

→ consultar_envio {"url": "https://seguimiento.correo-sol…
✗ Capability not granted:
  net("seguimiento.correo-sol.example.track-envios.net")

I couldn't open that link: the domain isn't the courier's,
it looks a lot like phishing. Your order P-101
shows as on its way.

─── the tool can only reach
    seguimiento.correo-sol.example

Plugins

Give it new abilities. Turn them on when you want.

A plugin is a small folder that teaches Lampson a new tool: query your database, call your company's API, deploy, send a message. Plugins are off by default — you switch each one on, and only then can the agent use it.

• A plugin is a folder with a plugin.json and a script in any language.
• A Synsema plugin runs under a capability ceiling; an executable one runs as is — either way, turning it on is your call.
• The agent can write a plugin for you — but never turn it on by itself.
• Keep plugins global (every project) or inside one project.

How plugins work →

$ ls ~/lampson/plugins/
example-hello/  deploy/  postgres/

$ cat ~/lampson/plugins/postgres/plugin.json
{
  "name": "postgres",
  "description": "read-only queries on the dev database",
  "kind": "exec",
  "command": "python query.py",
  "tools": [{ "name": "query", "readonly": true, … }]
}

lampson ❯ /plugins on postgres
☼ postgres is on — 1 tool available: plugin_postgres_query

Also in the box

The things you'd expect, without the setup.

• Sub-agents — it can split a job in parallel workers and gather the results.
• Skills — drop a SKILL.md in your project and the agent learns your procedures.
• MCP servers — the same JSON config you already use elsewhere.
• Language servers — go-to-definition and references instead of grep guessing.
• Sessions and traces — every step is saved; reopen a conversation days later.
• Images — paste a screenshot and ask about it.

Works with

Your API key is stored on your machine and only ever sent to the provider you chose. Lampson has no server of its own — nothing leaves your computer except your conversation with the model.