Overview
What OxLink is
OxLink is an interoperability layer. It gives systems and AI agents a common way to describe what they offer, ask to connect, agree on the rules, and keep a record of what happened.
It is not an AI model and it is not another assistant. It is the plumbing underneath: the part that decides who may connect to what, under which conditions, and for how long.
The problem
Every connection is built by hand
Every system speaks its own interface, and every AI agent invents its own way of working with them. So each new connection is built from scratch, with its own permissions, its own secrets, and its own idea of what is allowed.
The result is a pile of one-off bridges that nobody can see all of, and no single place to answer the questions that matter: who is connected, what can they do, and who agreed to it.
How it works
From a declared contract to a recorded result
A connection through OxLink moves through six stages. Each one can stop it.
- 01
Contract
A system declares what it offers and the rules for using it: which resources exist, what each one can do, and which actions need a person to approve them. The contract never holds a credential, and OxLink checks for embedded secrets before it accepts one.
- 02
Identity
Every request carries who is asking: an agent, a command line tool, a service, a person, or a scheduler. Policies can allow, deny, or require approval based on that identity, and the identity is written into the record of what happened.
- 03
Consent
Nothing connects on its own. One side requests a connection, and only the owner of the other side can accept or reject it. An undecided request expires, and so does a request whose other side goes away.
- 04
Bond
An accepted connection becomes a bond: the standing record that two exact parties agreed to work together. A bond ends the moment either side ends, when someone terminates it, or when the runtime restarts. Access is granted through short lived, signed, revocable leases that are re-checked against the live bond on every use.
- 05
Channel
Messages travel over OxIon, a separate data plane that only opens across a live bond. A notification says a message is waiting, never what it says. The receiver fetches it explicitly and treats it as untrusted input. Revoke the bond and the channel closes.
- 06
Record
Every run is written to an append-only audit record: who asked, which capability, what the policy decided, and the outcome. The record describes the action without copying the content through the control plane.
Principles
The rules it is built on
- Declared, not guessed
- A system says what it can do in a contract. Nothing is discovered by probing it.
- Consent before connection
- A person approves every connection. Possession of a token is never treated as permission.
- Credentials stay put
- Secrets are resolved inside the runtime at the moment of use. They are never handed to the agent or the model.
- Trust and transport are separate
- OxLink decides who may talk. OxIon carries what they say. Neither can do the other's job.
- Read first
- Today the runtime only reads. Writes come later, behind policy and approval.
- The smallest bridge
- OxLink creates only the connection a job needs, and it ends when the job or either side does.
With the SCA Runtime
OxLink connects. The Runtime governs.
OxLink answers who may connect and on what terms. What they are then allowed to do inside your business, which workflows run, what needs sign-off, and what gets written back, is the job of the SCA Runtime.
Kept apart, each stays simple enough to reason about. See how we handle security for the controls around both.
Status
What works today, and what is being built
OxLink is in active development. This list is kept to what actually runs.
Works today
- Repository contracts: a folder any AI agent can read to learn how to work with a project safely, including its commands, rules, and protected resources.
- Resource contracts for databases, APIs, and services, with typed capabilities and validation.
- A local runtime that runs read-only HTTP and PostgreSQL requests through a policy gate, with secrets resolved inside the runtime, size-capped responses, and an audit record.
- Identity-aware policy for agents, tools, services, people, and schedulers.
- Live Claude Code and Codex sessions that can see each other, request a connection, and accept or reject it, from inside the agent.
- Consent bonds with signed, revocable leases.
- The OxIon channel, carrying real messages between the two sides of a live bond.
Being built
- Write operations, behind policy and human approval.
- An orchestration layer where one primary agent delegates structured tasks to worker sessions, reviews the results, and reports back.
- Sessions and bonds that survive a runtime restart.
- Ready-made connections for business systems such as CRM, ERP, email, and documents.
- A public release.
Questions
What people ask first
Is OxLink an AI model?
No. OxLink does not reason or generate anything. It is the layer that decides which systems and agents may connect, under which rules, and keeps a record of what they did.
Does OxLink see our data?
The part that decides who may connect carries no content at all. Messages travel on a separate channel that only exists while a bond is live, and the runtime itself runs on your own machine rather than in a shared cloud.
Can an agent act without us knowing?
Not through OxLink. Every connection needs an explicit approval, every bond can be ended at any time, and every run is recorded.
Does it replace our existing software?
No. OxLink sits between the systems you already run and the AI that works with them. Your software stays where it is.
Can we use it today?
OxLink is in active development and not publicly released yet. If you want to see where it fits in your business, start with an architecture review and we will tell you honestly whether it is ready for what you need.
See where OxLink fits in your business.
An architecture review maps the systems you run and where a governed connection layer would help, and tells you honestly if it would not.
Start Architecture Review