The Agentic Index Brief

The week in one line

The agent signed in without ever seeing the password. Browserbase and Town handed the login step to 1Password, Island and Grok Bot built vaults the model never reads, and Inngest kept credentials out of the sandbox altogether. Between the agent and the approve button, Kiro, Gumloop and Composio each installed a second judge, so the agent now has a chaperone, and the chaperone is also an agent.

Between October 21 and November 1 the log recorded 247 entries across 247 vendors, 157 of them Verified against a primary source and 90 Partially Verified. Plain agent capability led with 79 entries, then MCP and tool calling with 40, integrations with 31, workflow orchestration with 21 and human approval and guardrails with 20. Halloween fell inside the window, which suits a stretch in which the category spent most of its energy deciding who gets let in, and on whose say so.

The agent got in and never saw the password

For most of the category's life the hardest part of putting an agent to work on the web was the login page. Either a person typed the password or the agent held it, and neither answer survived a security review. Since October 21 the password manager has stepped in between.

Browserbase added 1Password Agentic Autofill through its extension system. When an agent reaches a sign in form it asks for a specific login, the person approves or denies the request in 1Password on their own device, and 1Password fills and submits the credentials inside the browser, then clears them. Town wired the same password manager into its Townies, so tasks that sit behind a login page get finished and Town never sees the credentials.

Island built the vault into the browser itself. Enterprise Browser for Agents lets endpoint and cloud agents work in SaaS, internal and public web apps under the organization's policies. Admins set, per agent and per application, which pages an agent may use and whether it may write or only read. A built in vault fills in logins so passwords never reach the model's context window, and the audit log records whether a human or an agent acted. Grok Bot gained a Vault of its own for the logins, cards and contact details its Bots use to sign in or check out.

The same instinct reached the sandbox and the API. Command shims in Inngest 4.26.2 make a program inside a sandbox call a handler in the customer's own app first, so the privileged work happens outside the walls and credentials never enter the sandbox. The hosted MCP server from Maven AGI passes the signed in user's token through to agent actions without the model seeing it. And Artisan's agents now create website accounts with an email address and profile of their own instead of borrowing a person's.

Identity ran alongside. Okta Cross App Access now connects AI agents to third party MCP servers with no consent prompts at run time, and MCP servers registered in Okta can act as OAuth clients to the systems behind them, each with scopes that can be revoked on their own. Agenta runs schedules as the user or API key that created them, and pauses them the moment that identity can no longer act. Airtable's audit log now says whether a person or an agent took each action. And sites protected by hCaptcha can read Skyfire KYA tokens, so an agent arrives with signed paperwork saying who it works for and what it may do.

Approve for me

The approval prompt used to have two settings, ask about everything or ask about nothing. A third arrived, in which something else decides.

Kiro CLI 2.36.0 calls it Approve for me. In interactive sessions Kiro approves routine actions on the user's behalf, blocks risky ones and asks when it is unsure, marking each one it waved through as Approved for you. Existing deny, ask and allow rules still decide first. Grok Bot's Auto-review now asks less often when the user requested the action in their own words, which is a judgment about intent rather than a rule about commands.

Gumloop 13.2.0 put a model on the rule itself. Admins describe in plain language what a tool call must not do, and a decisions model judges each call against that rule to block it, tag it or hold it for a person. Composio Firewall checks every action an agent takes through Composio against the user's intent and the limits the developer and user set, then screens the tool results on the way back and blocks any that carry instructions. It is live for every Composio developer.

Where a person still decides, the decision got more exact. Action approvals in incident.io let admins set any write or destructive tool to Allowed with confirmation. The agent proposes the exact call, runs it only after the requester approves, and runs it as that person. Windmill 1.850.0 lets an agent step wait for approval of a tool call or put a question to a person in the middle of a run. Blits.ai 5.9 decides tool by tool whether the agent runs it alone, asks the customer or waits for an employee, and write actions on business systems now need approval by default.

Admins got a dial. UiPath's Autopilot Chat now works directly on the customer's Orchestrator tenant, with an approval mode that runs from asking before every operation to never asking. ControlUp turned Connect into Pulse AI Resolve, an agent on each employee's device, and let admins decide which fixes it may run alone, which need approval, and which devices are held to fixes the team has already reviewed.

And the other bookend arrived. Agent Kill Switch is generally available in Salesforce Agent Fabric, so a team can pull an agent offline from one place, with Model Wallet beside it setting hard spending limits that stop requests before costs pass the budget. ContraForce lets owners stop a gamebook while it runs, with the action in progress allowed to finish and nothing further started.

Everyone brought a dish to someone else's table

Thanksgiving came early for the assistants. Since October 21 the busiest place to launch a product has been inside Claude, ChatGPT, Copilot or Cursor, and almost nobody hosted at home.

GitHub Copilot opened Connectors in public preview on every plan, 26 verified MCP servers including Slack, Figma, Notion, Sentry, Linear and Vercel that a developer signs in to once and then uses across the Copilot app, the CLI, VS Code and GitHub Mobile. Databricks gave ChatGPT, Codex, Claude, Claude Code and Cursor default OAuth client IDs for its MCP servers, so an admin no longer builds an OAuth app for each one. Microsoft let admins create custom MCP connectors in the Microsoft 365 admin center and deploy them across the organization.

Vendors carried their products through those doors. Gainsight's CSM Adoption Agent is a Claude plugin that finds customers with adoption gaps over the Gainsight MCP connection and drafts an email for each, with the CSM approving, editing or rejecting every one. Greenhouse in Claude moves candidates, schedules interviews and drafts scorecards from live hiring data. Better Stack put its AI SRE inside Claude as a free plugin, so a routine fired by an incident webhook can come back with a root cause, a mitigation plan and a pull request. Dataiku's Headless lets Claude Code, Codex and Cursor build Dataiku projects by handing the work to Cobuild, and Itential published open source skill packs that run its platform from four coding agents.

The customer facing agents followed. Maven AGI's hosted MCP server puts a company's support agent inside ChatGPT, Claude, Muse, Cursor and any remote MCP client through one tool, ask_maven, with a conversation ID that keeps the thread going. Wonderchat Helpdesk lets Claude, ChatGPT, Cursor or any MCP client work the support queue. Startups on Stripe Treasury can let ChatGPT or Claude check balances, pay invoices and move money through Stripe's MCP server, with the business choosing what each agent can reach and when a payment needs a person. Firecrawl's new Government & Legal Index, 30 million pages of US statutes, city codes and court opinions, is reachable as a Firecrawl plugin in ChatGPT and Claude and uses no credits.

The plumbing kept pace. Glean added 57 remote server templates to its MCP library. Harvey, Monte Carlo and Sourcegraph all let customers bring their own MCP servers, Monte Carlo limiting them to read only tools. Mastra taught MCP servers to push events to agents instead of only answering requests, and Arcade's MCP Apps let a tool show an interactive interface inside the chat rather than a block of text, with a Send button appearing only where the user's permissions allow one.

Two doors closed on the way in. Smithery shut its connection management services on October 31. Its server URLs, API, CLI, SDKs and accounts stopped working, and what remains is a public directory of MCP servers listing each one's direct URL. Google Jules turns read only on November 11 and winds down on December 31, with a CLI to export settings, memories and full session history first.

The voice agent learned to wait its turn

Dead air and talking over the caller were the two tells of a voice agent. This time the model vendors went after both at the model layer rather than in a timeout setting.

Deepgram's Think-Live is a model built only to run the live conversation, deciding when to listen, wait or respond, and it is generally available in the Voice Agent API alongside whatever model a team already uses for the thinking. Phonic's Phonic-1 calls tools and acts while the caller is still talking, so the answer is ready when they stop, and switches among more than 50 languages mid call. Rime's Prism handles turn taking and interruptions on its own and speaks filler lines while a team's tools run. Retell's new duplex engine pairs a realtime speech model with a text LLM behind it, and Cartesia launched Managed Agents with the voice models and the harness designed together, at $0.03 a minute while the launch price lasts.

Delivery got a director. Inworld's Realtime TTS-2 gained a Reasoning mode that reads the line and its context, writes itself a short direction such as warm and delighted, and then performs it. Pipecat 1.15.0 lets the LLM write expression tags into its reply for the voice service to perform, and its new Tone models tell the LLM how the caller sounded on each turn. Regal's Goal Oriented Agents split the job in two, a fast actor model that carries the conversation and a director model that checks progress after every turn and moves the call along.

Testing caught up with the ear. Aircall's Simulations have an AI caller hold practice conversations with the real agent on its actual setup, each scored against the team's own success criteria. Classifiers in Confident AI now listen to the audio itself, catching interruptions, awkward silences and tone problems a transcript never shows, with a person confirming each label before it sticks. Sierra's Compliance Console sets the rules for outbound calls and texts, from disclosures and calling hours in the recipient's local time to regional holidays and opt outs. And Smith.ai's receptionist now tells apart ten kinds of caller instead of four, adding six built for law firms, among them Opposing Party and Incarcerated Caller.

The agent built its own tools and filed them as drafts

Agents started extending themselves, and vendors agreed on what happens next. It becomes a draft.

An xpander agent can now build its own tools, a skill, a connector generated from an OpenAPI spec with its OAuth sign in, or a desktop connector that records the steps of an app with no API, and every one starts as a draft that admins test and approve in a registry. Lindy Apps lets a team ask Lindy in Slack to build an internal tool such as a deal room or an approval board, each with its own data, link and rollback, reading and writing to connected tools with a separate permission for each. Agno's CompanyOS gives agents standing areas of responsibility with sources to watch. Scheduled Routines read those sources and propose projects and tasks, and agents carry them out once a person approves.

Teams of agents got a manager. Swarms in Grep AI, formerly Parcha, put a coordinating agent over specialists with their own instructions, skills and tools, run across a list with a cost limit on each run. A parent session in Moderne CLI 4.12.0 can see, steer and stop the sessions it starts, and goose 1.56.0 can resume a subagent that failed instead of starting over, with a cap on how many run at once.

Work kept going with nobody watching. Anvilogic Blueprints now run on a cron schedule whether or not anyone is online, pausing at approval steps until a person signs off. Inbound webhooks on Trigger.dev let events from Slack, Stripe, GitHub, Linear and more than 40 other services start agents directly, each verified, checked for duplicates and stored before it reaches as many as 25 matching agents. The new /goal command in OpenCode keeps a session working toward an objective until a reviewer confirms it is met.

The finished work arrived with the approval built in. Replit's Cloud Agent, now open to enterprise teams, finds the code, makes the change, tests it in the running app and opens a pull request with screenshots and video. StackAI's Self Healing Workflows propose a fix when an evaluation score drops, apply it to a draft and rerun the evaluation so the team can compare before and after. The Eval Health agent in Arize files an issue for every broken or missing eval with a proposed fix, and nothing changes until someone accepts.

Security agents went looking for trouble on purpose. Deep scans in Devin Security hunt for chained exploits across large codebases, any proposal to relabel a finding needs a person, and vulnerabilities on the KEV list are never relabeled at all. Sonar's Remediation Agent returns each fix as its own pull request and never merges. Roomote checks repositories against CVE records and proposes fix pull requests, off by default and never merged on its own. And RunSybil's Continuous Coverage tests what changed in an application as often as daily instead of waiting for the next pentest.

Market notes

Routing moved inside the product. OpenRouter's default routing no longer picks mainly on price. It tracks each endpoint's price, latency, throughput and error rate and steers around trouble, and OpenRouter measured time to first token 16.9% better, throughput up 16.3% and capacity errors down 46%, at 6.0% more cost. Blackbox AI's gateway sends each step of a coding session to a frontier model, a large open weight model or a small one depending on how hard the step is, and completed 65% of Terminal-Bench 4.0 tasks at 38% lower cost per task than sending everything to Claude Opus. Clay's Claygent picks a model per research task with a router Clay trained itself, and Instabase lets a project pick its provider once and keep it.

The model moved toward the customer too. Actian AI Analyst, formerly Wobby, can now run self hosted with the customer's own OpenAI or Anthropic account, or a model reached through Bedrock, Vertex, Azure or an enterprise gateway. TrueFoundry went the other way for teams who would rather manage no keys at all, offering curated models on its own capacity against a prepaid credit balance that never expires.

Budgets became a feature. Tabnine 6.7.0 lets administrators set an organization wide monthly Agent budget and hide usage costs from end users. Spinnable caps the credits a single worker may use each billing period and pauses a recurring task after three failed runs. Claude Code 2.1.316 added pooled group budgets to its gateway, and Haystack breaks AI spend down by model, agent, service and team next to production traces. ThoughtSpot's new AgentSpot charges per conversation, workflow run or app session rather than per token or seat, with unlimited agents on the free plan, and HighLevel bills a web search inside a workflow at 1 cent with OpenAI and Claude models and 1.4 cents with Gemini.

The regulated and the governmental bought in. Langfuse v4.71.0 added FIPS mode for self hosted Government deployments and moved every image onto Iron Bank's hardened Red Hat UBI 9. Hatchet now publishes a FIPS 140-3 version of every server image. Temporal Proxy, in public preview, encrypts workflow payloads in the customer's own environment so Temporal Cloud stores only ciphertext it cannot read. OpenBox can now be bought on AWS Marketplace and run entirely inside the customer's own account and VPC, and SS&C Blue Prism opened WorkHQ in Canada Central and a FedRAMP authorized GovCloud region.

Commerce kept wiring itself up. Shopify storefronts gained a /buy route that packs items, discount codes and the buyer's details into one Universal Commerce Protocol link straight to checkout, and Sidekick now tests a proposed storefront change against simulated shoppers before the merchant decides. Siena's agent creates returns and exchanges in Loop Returns inside the conversation and hands over the prepaid label.

Halloween fell inside the window, and five vendors turned up in costume. CalypsoAI now ships as F5 AI Guardrails, Wobby as Actian AI Analyst, Parcha as Grep AI, Voxia as Callers, and ControlUp Connect as Pulse AI Resolve. For scale, DBOS ran durable workflows on sharded Postgres from 20,000 a second on one server to a million a second on 50 shards, with the benchmark code open source.

In the regulated verticals, Abridge's In-Visit Orders picks up the orders a clinician talks through with a patient and stages them in Epic to review and sign before leaving the room. Legora paired collected US primary law with a map of how sources connect, so its agent sees that a case was overruled when it cites one. Clio Work fills in the submission form on a court's own electronic filing portal from matter details already in Clio, with the lawyer reviewing and submitting every filing personally. And Luminance's Lumi writes the comments in Word that explain to the other side why each redline was proposed.

What the period says about the category

Two hundred and forty seven entries, and most of them answer one question asked from different sides. Who lets the agent in, and on whose say so?

The password manager lets it in and keeps the password. A judge model approves the routine and flags the rest. The assistant the company already pays for is the door the product arrives through. And when the agent makes something, it arrives as a draft with a person's name on the merge.

None of it slows the agents down. It lets everyone else stop watching them, which is the point at which a tool becomes a coworker.

The agent is still the new hire who does not have the password. As of November, nobody is trying to give it one.

Index Answer

Which AI agent platforms let you bring your own model or route between models?

About four in ten, and they tend to be the better governed ones. Of the 616 platforms the Agentic Index grades across its four horizontal lanes, 245 document model flexibility in full. A buyer can bring their own model or key, or route between providers, rather than accept the one the vendor picked. Another 87 document it in part, and 276 do not document it at all.

Model choice keeps good company. Across the pool, 145 of 616 platforms, about 24 percent, clear the four capability governance bar used on the enterprise security page, with security and identity, deployment and residency, observability and human oversight all documented in full. Among the 245 model flexible platforms, 99 clear it, about four in ten. If model choice and governance had nothing to do with each other, about 58 platforms would do both. The actual number is 99.

The gap that remains is the model in the box. Of the model flexible platforms, 190 also document deployment inside the customer's own boundary, while 55 let you point them at your own model while the software stays in the vendor's cloud. Going the other way, 46 platforms clear the whole governance bar and still choose the model for you.

The releases since October 21 moved the question from whether you can choose the model to who chooses it, and how often. OpenRouter's default routing now weighs latency, throughput and error rates alongside price. Blackbox AI sends each step of a coding session to a different size of model, and Clay's router picks a model per research task. Actian AI Analyst and Instabase went the other way and let the customer pin a provider. All of it counts as model flexibility. One kind is a setting you review once, and the other is a decision made a thousand times a day by something you did not configure.

The bar, the method and the 245 platforms that clear it are on the Agentic Index bring your own model page.