Superagent: a general-purpose agent with a human in front of it

Most agent demos are a single clever turn. The hard part is the hundredth turn: the agent still knowing what it is doing, still inside its budget, still unable to do the one thing nobody authorised.

Superagent is our attempt at that. It is built on Anthropic’s Claude Agent SDK, which supplies the loop and the base tools, so the work we do on top is the part that decides whether an agent is safe to leave running: budgets, permissions, memory, and the gate in front of anything that cannot be undone.

What it does

Takes an outcome, not an instruction. You describe the job. It plans, uses tools, checks its own work and continues until the task is done or a spend limit stops it.

Connects to real systems. Connections are built for search and advertising data, analytics, spreadsheets, commerce, code hosting, the open web and email. Each one is a deliberate integration with its own spend gate, not a generic plugin surface.

Runs in an isolated sandbox. Each session gets its own environment, so what the agent runs stays inside a boundary rather than on the machine that started it.

Remembers between conversations. A notebook in plain markdown on disk, split into who it is, what it is working toward, and what it has learned. Readable, diffable and editable by hand, so nothing is trapped in a database you cannot inspect.

The parts we would want a client to ask about

Irreversible actions park for a person. Writes to live systems wait on a human answer, and every non-answer counts as a denial. Silence never approves anything.

The agent can propose changes to its own instructions, but not make them. Updates to its identity or its goals go through the same approval gate as any other write. An agent that can quietly rewrite its own instructions does not have instructions.

Text it merely read cannot become an order. Every remembered note records where its content came from. Anything from the open web or an unclassified tool is fenced and labelled as data before the model sees it, because a note written today outlives the session that carried it.

Both of those boundaries were found by attacking them rather than by reading the code, and the second one was rewritten after an attack worked in testing. We would rather say that than present the design as though it arrived correct.

Every push runs typecheck and the test suite. That is enforced in CI rather than by anyone remembering, which is the same standard described in our methodology.

Where it is

In development, and running on our own work. There is no signup, no pricing and no availability date, and we are not going to publish performance numbers for it before we have numbers we would defend.

The honest summary: it is the clearest example we have of how we think agent systems should be built, which is why it is on this site at all. If you want to see it work, ask and we will show you rather than send you a video.

Why it is here rather than in a drawer

We build a product when the same work shows up across enough engagements that automating it is cheaper than repeating it. Superagent came out of that, and it is also where the ideas get tested before they reach a client’s systems. The approval gate on this page is the one we put in front of client agents. The memory boundary is the one we would apply to a client’s notebook. Building it in the open is how we find out which of our own rules survive contact.