SmythOS

The integrations documentation enumerates 76 named integrations grouped into eight classes the vendor labels itself: workflow triggers, AI models and tools, data and knowledge, business apps, messaging and alerts, analytics and scraping, developer tools, and publishing.

Breadth spans CRM (HubSpot, GoHighLevel), project and issue tracking (Jira, Linear, Asana, ClickUp, Trello), commerce and payments (Shopify, Stripe), storage and productivity (Google Workspace, SharePoint, OneDrive, Notion, Airtable), messaging (Slack, Teams, Discord, Telegram, Twilio), email (Gmail, SendGrid, Mailchimp, Resend), databases (Supabase, Firestore, Upstash) and CMS (WordPress, Webflow, Squarespace).

Credentials are stored once in the Vault and actions wired into any flow without HTTP or SDK work, alongside a 40-plus component library and a generic OpenAPI component for anything unlisted.

Sourcesmythos.com/docs/agent-studio/integrationsread 2026-09-01

Multi-agent orchestration is the product's stated purpose: cooperative planners, delegators and specialists, with one agent able to review and refine another's output, and a SmythOS Agents component that lets an agent call other built-in agents as tools.

The runtime carries orchestration as a kernel responsibility rather than a graph library, documenting retries, cancellation, priorities, shared memory and message buses, with packaging, isolation and lifecycle management across local, cloud and edge.

Workflows are built on a drag-and-drop canvas with logic components and multi-step reasoning, and a single agent specification spans Studio, SDK and CLI without rewrites.

Sourcesmythos.com/product/agent-runtime, /docs/agent-studio/overview and /docs/agent-studio/integrationsread 2026-09-01

Studio ships a first-party Data Pool with Data Spaces, documented as centralising the agent's knowledge base with structured storage and retrieval, which is a maintained retrieval structure the customer populates rather than per-request assembly. The runtime exposes vector databases as an OS-level abstraction alongside storage and caching, and the security documentation confirms embeddings are held and encrypted as a first-class data type. Graded on the first-party knowledge store; the third-party document and database connectors are counted on Integrations, not here.

Sourcesmythos.com/docs/agent-studio/overview and /product/securityread 2026-09-01

One configurable guardrail is shipped and no approval mechanism is: components can be disabled or removed entirely from a bundle so they are unavailable to agents, which lets the buyer decide what an agent may never do. The Full bar asks for oversight as a configurable control over sign-off, meaning who approves which actions and what happens when nobody does, and none of that is documented: no per-action approval step, no pause-and-confirm, no review queue and no escalation path was retrieved on either pass.

The control-plane language on the homepage is a governance essay rather than a shipped mechanism and is refused. Note that the access-control surface, the ACL and Candidate system and the four named roles, is graded on Security and is not counted again here. Resolves an Unspecified cell on the guardrail half alone; the published Partial marker describes a human handoff in one place, which this record also lacks, so the grade rests on guardrail configurability under the axis definition rather than on that marker.

Sourcesmythos.com/product/securityread 2026-09-01

Three of the four published Full controls are documented and one is missing.

Present: a named access model, with an internal ACL and Candidate system enforcing least privilege plus role-based access naming Super Admin, Agent Viewer, Integration Engineer and Agent Builder, per-space key vaults and strict per-tenant and per-agent namespace isolation; an audit surface, with logs of agent activity, execution flows and access decisions, configurable verbosity, SIEM aggregation and regex redaction; and a compliance page a buyer can read without a call, covering vault integration with HashiCorp Vault and AWS Secrets Manager, TLS 1.2+, and KMS encryption at rest.

Missing: identity integration, with no SSO or SAML documented anywhere on the security page or product pages. No certification of any kind is published either, so a buyer gets a detailed account of who can make an agent do what and no independent assurance of it. Held at Partial on the missing identity half rather than on the absent attestation, which the published bar does not require for Full.

Sourcesmythos.com/product/securityread 2026-09-01

The security documentation describes full audit logs of agent activity, execution flows and access decisions exposed through the SRE logging interface, with verbosity configurable up to high and the option to track specific components, real-time logging and monitoring for debugging and incident response including third-party token usage, aggregation into enterprise SIEM systems for analysis, auditing and alerting, and partial redaction driven by patterns and regular expressions with a worked example redacting an authentication token.

The reconstruction half is met by the canvas walkthrough of each step of the agent's reasoning from raw input received to decision returned, and Studio ships an analytics view for token usage and cost. Logged access decisions are the vendor's own runtime output, not the customer's systems supplying the record.

Sourcesmythos.com/product/security and /docs/agent-studio/overviewread 2026-09-01

Memory is documented as a primitive rather than as a persistence product.

Studio states that workflows are built with logic, memory and multi-step reasoning, the runtime carries shared memory alongside retries, cancellation and priorities as a kernel responsibility, the security documentation treats cached memory as a first-class encrypted data type, and the Upstash integration is offered for storing session data using Redis or Kafka.

What was not retrieved on either pass is the discriminator for Full: no documentation of state persisting across sessions and addressable by the agent, whether accumulated automatically or wired from the supplied primitives. The dedicated components reference was not opened and would settle this cell.

Sourcesmythos.com/docs/agent-studio/overview, /product/security and /product/agent-runtimeread 2026-09-01

Three deployment surfaces are documented with distinct data postures: the multi-tenant SmythOS SaaS with per-tenant logical segregation; on-premises or VPC deployment inside the customer's own data centre or cloud, stated to guarantee that data never leaves the customer's environment and to support internal residency and monitoring policies; and on-device deployment bundling one or more agents with the runtime into a standalone executable for controlled or offline environments. Studio itself is self-hostable from a Docker community image, the runtime is MIT-licensed at roughly 50 megabytes and runs on cloud, on-premises, edge, desktop, mobile or containers with GPU optional, and storage backends are selectable between local disk or RAM and remote S3 or Redis.

Sourcesmythos.com/product/security, /docs/agent-studio/self-hosted/docker-community and github.com/SmythOS/sreread 2026-09-01

A browsable template catalogue is published at smythos.com/templates and carries its own documentation domain, described as prebuilt customisable templates for common use cases that a customer picks, drags, drops and deploys with no code, spanning support, research and operations. The vendor frames these as instant agent blueprints organised by department, and the Studio documentation lists template-started builds alongside the quickstart as a first-class entry route. Packaged assets adoptable directly by the customer rather than configurations assembled by the vendor's team.

Sourcesmythos.com/templates and /docs/agent-templates/overviewread 2026-09-01

The integrations documentation opens with a Start Workflows section stating agents can be triggered by forms, calendar events, chat messages or webhooks, and names nine trigger integrations: Slack slash commands and mentions, Discord bot messages, Telegram bot commands, Google Calendar and Microsoft Calendar events, Google Chat space triggers, Microsoft Teams channel messages, Ayrshare social post triggers and tl;dv meeting transcripts. The Studio documentation adds deployment to production via chat, API or webhooks, and the product site documents scheduled runs where agents clock in automatically, bulk CSV-driven runs, and web chat and voice as delivery surfaces.

Sourcesmythos.com/docs/agent-studio/integrations and /docs/agent-studio/overviewread 2026-09-01

The customer chooses the model across three documented tiers: public API models with OpenAI, Google Gemini, Groq and Perplexity named; hosted enterprise services with Google Vertex AI and AWS Bedrock named, retaining provider-level residency and compliance; and local or self-hosted models run on-premises or in a private cloud so no data leaves the customer's environment.

The product site states models can be switched and added on the fly without a rebuild or redeploy, and the integration catalogue adds OpenRouter for unified access to GPT, Claude and Mistral, plus Hugging Face and Replicate for open-weight models. Model choice is a first-class control surface, not vendor-internal routing.

Sourcesmythos.com/product/security, /product/agent-runtime and /docs/agent-studio/integrationsread 2026-09-01

A finished agent can be exposed as an API, a model endpoint, an MCP server, a web chat or a voice interface, which makes the platform callable from outside by a documented interface rather than only usable inside it.

The runtime, CLI and SDK are published open source under the MIT licence with SDK and core documentation and runnable examples, the Studio is available as a Docker image, an embeddable route is documented, and an OpenAPI component generates flows from specifications or tests endpoints.

The vendor also publishes an MCP server that spawns Linux sandbox containers, credited here rather than on Model under the one-line test, since the caller is the customer's assistant.

Sourcesmythos.com/docs/agent-deployments/overview, github.com/SmythOS/sre and github.com/SmythOSread 2026-09-01

Studio documents no-code debugging and testing that inspects live runs and fixes issues inside the canvas, with a dedicated Debugging Agents guide and a step-through of the agent's reasoning from the raw input received to the decision returned.

What is absent is a criterion: nothing states what a run is being checked against, so the surface reveals what happened without deciding whether it was right. That is inspection rather than evaluation, and it is the published Partial marker for this axis, debugging rather than testing. No evaluation harness, scored test case or gate that passes or fails was retrieved on either pass.

Sourcesmythos.com/docs/agent-studio/overview and /docs/agent-studio/build-agents/debugging; smythos.com/docs/agent-studio/build-agents/debuggingread 2026-09-01

Third-party browser and retrieval engines are wired in as integrations rather than owned by the platform, which is the published Partial case for this axis. The Studio catalogue ships ScrapingBee as a web scraping API and AvesAPI for SERP scraping, alongside Perplexity and Tavily as search APIs, so the agent reaches pages it does not have an interface to.

What is absent is the Full case: no hosted or local browser the platform drives itself, no desktop session and no remote computer control appears anywhere in the component library, the runtime documentation or the security page. The Linux sandbox containers spawned by the vendor's Docker orchestration MCP server are an execution environment, not interface control, and are excluded. Corrected from an initial grade of none, which read scraping as zero; the published bar places wired-in third-party engines at Partial.

Sourcesmythos.com/docs/agent-studio/integrations and github.com/SmythOSread 2026-09-01