Technical & Security Overview
A platform for software work — tickets, knowledge, memory, and MCP tools — with an optional team of AI agents that plan, build, review, ship, and improve your code.
Want the less technical version? Read the product overview →What it is, at a glance
Run the full team, a single agent, or none at all — the platform is useful on its own, and you choose which agents run and how much they do.
Coordinated by rules
Work moves through the team on a fixed, predictable path — not by an AI improvising. Behavior is consistent and auditable.
Checked before you see it
Every change is reviewed and tested before it reaches you. You’re the final decision; nothing ships without your approval.
Improves on its own
The Researcher spots issues and proposes fixes. You approve what gets done; it never changes code on its own say-so.
Where you already work
It lives in your GitHub, ships as pull requests, and works on the codebase you already have — no greenfield required.
Your side
Your GitHub repositories
Multi-repo · pull requests
YATFA service
API · web UI · work state
Real-time · full history
Agents
Sandboxed containers
The agent team
Security model
No single control is enough on its own. The layering is what makes agents-on-production-code acceptable — each control covers the failure modes the others don’t.
-
Isolated containers. Agents run in sandboxed containers and cannot touch the host, your local environment, or any repository you haven’t authorized.
-
Feature branches, human merge. All changes happen on feature branches. Nothing reaches a default branch without review and a human merge — the agents do the work; shipping is always yours.
-
Role-scoped permissions. Each agent sees only the tools its job needs, enforced server-side on every call. An agent that builds can’t approve its own work.
-
Strict project isolation. Your code and data are walled off from every other project and customer. An agent cannot reach another project, even by accident.
-
GitHub App authentication. GitHub access uses a GitHub App installation you authorize — no personal tokens are stored, and access is revocable.
-
Auditable, and secrets stay yours. Every agent action is logged. Agents are instructed not to store raw credentials; sensitive material stays in your existing secret-management practices.
Questions technical leads ask
Do we have to run autonomous agents?
No. The platform stands on its own — tickets, proposals, roadmaps, a versioned knowledge base, semantic memory, and MCP tool access, all from the web UI or any MCP client. Agents are optional; turn them on when you want them.
How does it work with our GitHub workflow?
GitHub-native: GitHub App authentication (no personal tokens stored), PR-based shipping, multi-repo support, and two-way comment sync. It fits the workflow you already have.
Does it work on our existing codebase, or only greenfield?
Existing codebases, primarily. Agents read what’s there and follow the patterns you’ve already established, so new work fits in naturally.
Can we drive it from another tool?
Yes. The MCP surface is exposed over a stdio bridge, so a workspace can be driven from any standard MCP-compatible client (such as Claude Desktop, Cursor, Visual Studio Code, or similar) with the same capabilities.
What do we need to run it?
If you run agents: a Docker-capable machine (laptop, server, or cloud VM) for the runner, and the GitHub repositories you want it to work on. Token usage is included in your plan, with configurable project budgets — no need to manage vendor API keys. Without agents, just a browser and a GitHub repo.
What if something goes wrong?
Every change is a clean, reversible step on a branch. If work is stuck or unclear, it’s flagged to you rather than handled quietly — you’re never surprised.
Want the plain-language version?
The product overview explains the same system for founders, PMs, and leaders — no architecture required.