Synthe

Who it is for

Three situations where an agent's push is the risk. For each: what is true today, what changes with Synthe, and what stays yours.

Teams running coding agents

The situation

Your agent has a GitHub token, so it can push anywhere that token reaches. One bad prompt or one confused loop, and the damage is already on the remote.

With Synthe

The agent holds no credential. When it wants to push, it proposes. You read the real diff and approve it with Touch ID. Synthe pushes exactly that commit, to an agent/* branch, and signs a receipt.

You still own

Reviewing and merging to main, the way you do today. Synthe never merges. It cannot make an agent write good code. It stops bad code landing without you.

How it worksRace two agents

Platform and security teams

The situation

You need to say what your agents did, and prove it. Logs the agent can edit do not prove much.

With Synthe

Every approval and every refusal is a signed, hash-chained receipt. Anyone can check the chain with the broker's published key and a standalone verifier. The broker's code is public to read and audit.

You still own

The setup the wall depends on: the agent in its own account, with no credentials. Synthe produces evidence. It does not make you certified or compliant.

Tamper evidenceReceiptsSecurity and limits

Teams building their own agents

The situation

Your agent plans well and calls its tools well. Publishing is the one step you least want it to do alone.

With Synthe

Your agent keeps its own planner and tools. Only its final push changes: through a plugin, a tool connection or a plain git push, it proposes instead of publishing.

You still own

Deciding what the agent may change. Setup asks for the branches and paths, and the broker refuses anything outside them.

IntegrationsDocs

Not a fit yet

The limits, so you do not find them out later.

  • Synthe guards git push today. Sending email, deploying and other actions are not covered.
  • The wall is a separate account on a machine you control. An agent that runs entirely in a vendor's cloud, with no machine of yours, is not covered today.
  • macOS is the verified path. The Linux setup is built and tested, but has not run on a clean live Linux host yet.
  • Nobody outside the team has run the install unaided yet. That test is planned.

Not sure whether it fits? Answer five questions, or talk to us.

Do I need this?Become a design partner