docs-mcp

English | 简体中文

Interested in Tandem Hosted? Join the waitlist

Tandem

Tandem enforces policy between AI agents and the tools, data, memory, and actions they use.

Agents can reason, draft, and propose work. Tandem decides what they are authorized to see, which tools they can call, which actions must pause for approval, what memory/context they can access, and what evidence gets recorded.

This makes Tandem useful when agents touch real company systems: files, repositories, email, MCP tools, customer data, internal docs, production workflows, and long-running automations.

For platform and security teams, Tandem acts as a runtime control plane for agentic systems: scoped tool access, approval gates, permissioned memory, tenant/resource boundaries, and audit evidence.

The model proposes. Tandem enforces.

In governance terms, Tandem manages delegated authority for AI agents at runtime.

What Tandem Does

• Runs AI workflows with durable state instead of transcript-only execution.
• Scopes which built-in tools and MCP connectors are visible at each workflow step.
• Blocks tool calls that fall outside runtime policy before execution.
• Pauses consequential actions for human approval.
• Controls which company memory and context a run can retrieve.
• Records artifacts, tool events, approval decisions, and audit evidence outside the model context window.

Simple Example

An agent may be allowed to draft a customer email, but not send it.

Tandem can expose the draft tool, hide or block the send tool, pause at an approval gate, resume only after a human approves, and record the decision in the audit trail.

What Tandem Is Not

Tandem calls this runtime authority: authorization, execution control, approval, scoped memory, and audit enforced outside the model. Entrypoints such as the desktop app, TUI, web control panel, channels, and SDKs are clients of the same engine runtime.

• Runtime-owned controls: Runs, sessions, memory, context, provider secrets, MCP tools, approvals, artifacts, and audit records live outside the model.
• Governed tool execution: Built-in tools and MCP connectors can be scoped per workflow step, with approval gates for consequential actions.
• Tenant-aware runtime: Hosted and enterprise modes carry tenant/principal context through sessions, runs, context runs, memory, provider credentials, MCP secrets, and events.
• Deployable where the data lives: Tandem can run locally, headlessly, hosted, or inside customer infrastructure.
• Provider agnostic: Use OpenRouter, Anthropic, OpenAI, OpenCode Zen, or local Ollama endpoints.

Agent intent -> Runtime policy -> Scoped tool/data access -> Approval gates -> Artifacts -> Audit trail

-> AI runtime infrastructure | Enterprise readiness | Runtime trust boundaries | EU AI Act readiness | Compliance starter pack | Connect an agent via MCP

Why Tandem Exists

Agents are becoming workers. They read company context, call tools, open pull requests, draft customer communication, operate project boards, and prepare decisions that used to stay inside human-only systems.

Prompts are not permissions. A system prompt can ask a model to avoid a tool, skip a folder, or wait for approval, but the model should not be the security boundary. Tandem puts those controls in the runtime, so a workflow can grant the agent only the tools, memory, and actions needed for the current step — and deny anything outside that scope.

Companies also need central AI context without flat access. A permissioned company memory should know what the company knows, but an agent acting for one team, tenant, project, or user should only retrieve the slice it is allowed to use.

What Tandem Governs

• Company knowledge and memory: Runtime-owned memory, knowledge spaces, and retrieval paths designed around tenant and workspace boundaries.
• Tool and MCP visibility: Step-scoped built-in tools and MCP connector tools, with broader pre-invocation masking planned for enterprise deployments.
• Workflow execution: Durable automation and context-run state instead of fragile transcript-only execution.
• Human approvals: Runtime gates pause runs, collect approve/rework/cancel decisions, and leave evidence.
• Tenant and workspace boundaries: Tenant-aware sessions, runs, context runs, events, provider credentials, MCP secrets, memory, and contract vocabulary for resource scopes and grants.
• Connector credentials and secrets: Provider and MCP secret references are runtime-owned; connector source binding gives scoped ingestion a shared contract as that layer matures.
• Artifacts and audit trails: Outputs, validations, tool ledger events, approval decisions, and protected audit records survive outside the model context window.

Core Use Cases

Why Platform And Security Teams Care

Tandem is designed for teams that need to run AI work under real operational controls:

• Runtime authority, not prompt authority: The model can request context or a tool call; the runtime decides what is visible and executable.
• Tenant-aware records: Sessions, automation runs, context runs, event streams, provider credentials, MCP secrets, and memory paths carry tenant context in hosted/shared modes.
• Resource and grant model: Tandem models resources, principals, grants, data classes, and data boundaries so access decisions can be enforced by the runtime.
• Permissioned memory: Memory and knowledge paths carry tenant boundaries so company knowledge can become useful without becoming globally flat.
• Deployable runtime: The same runtime can run on a laptop, as a headless engine, hosted, or inside customer infrastructure as the enterprise layer matures.
• Auditability: Approval decisions, policy denials, provider secret changes, MCP activity, tool ledger events, artifacts, and protected audit records can be inspected outside chat transcripts.

Deployment Model

Tandem is useful locally and grows toward stricter company deployments:

• Local desktop: Single-user desktop runtime with local workspace scope, provider setup, and approval-gated tools.
• Headless engine: tandem-engine serve for SDKs, control panels, automations, and CI/dev environments.
• Hosted/private managed: Hosted deployments with transport-token and signed context assertions for tenant-aware access.
• Customer infrastructure: A deployment model for running where company data, connector credentials, and operational evidence need to live.

Current Status

Compliance and AI Act readiness

Tandem helps teams operate AI workflows with human oversight, scoped tools, durable execution evidence, and protected-action controls. For regulated or security-sensitive deployments, start with the EU AI Act readiness brief, then use the Compliance Starter Pack for control mapping, Article 50 transparency guidance, deployer instructions, an Annex IV documentation template, and a limitations/responsibility matrix.

30-second quickstart

Web Control Panel

Install the master CLI, then bootstrap the panel and its engine service:

npm i -g @frumu/tandem
tandem install panel
tandem panel init
tandem panel open

Use this when you want the browser-based control center backed by the engine.

For local installs, you can now open Settings -> Providers -> openai-codex and choose Connect Codex Account to sign in through the browser instead of pasting an OpenAI API key.

Desktop

1. Download and launch Tandem: tandem.ac
2. Open Settings and add a provider API key, or use the local control panel to connect a Codex account for openai-codex.
3. Select a workspace folder.
4. Start with a task prompt and choose Immediate or Plan Mode.

Editable App Scaffold

Generate a fully editable control panel app in your own folder:

npm create tandem-panel@latest my-panel
cd my-panel
npm install
npm run dev

Use this when you want to customize routes, pages, themes, styles, or runtime behavior without editing node_modules.

MCP-assisted setup

If you want an existing agent to help install or configure Tandem, connect that agent to Tandem's MCP interface first. The MCP docs explain how to wire your own agent into Tandem so it can assist with setup, configuration, and follow-up tasks:

• Tandem MCP docs

If you only want the engine runtime, you can keep it foreground-only:

tandem-engine serve --hostname 127.0.0.1 --port 39731

Other Entry Points

• TUI: npm i -g @frumu/tandem-tui && tandem-tui
• SDKs: npm install @frumu/tandem-client or pip install tandem-client

Codex And Docker Setup

• Codex users can connect Tandem through the tandem-codex-plugin repository.
• For a Docker-based Tandem agents setup, see tandem-agents.

Open Core & Source-Available Architecture

Tandem is built for developers first, using an open-core model. We believe that to trust an AI runtime, you must be able to audit the execution router line-by-line.

Local Development & Evaluation: The permissively licensed crates and libraries (MIT OR Apache-2.0) may be used under their own terms. Every distributed engine binary also includes the source-available BUSL-1.1 components, which are free for evaluation, development, testing, source inspection, personal non-commercial use, and non-production proofs of concept.

Enterprise Path: Advanced features for scaled organizational deployments, such as enterprise identity federation, richer policy enforcement, signed receipt chains, private sidecar enforcement, SIEM export, and HA packaging, are planned enterprise capabilities and may be governed under commercial or source-available terms, including the Business Source License 1.1 (BUSL-1.1) where declared.

License Boundary: Commercial production use of the BUSL-1.1 components — including internal production use, client production deployments, and managed, hosted, SaaS, white-label, embedded, OEM, or reseller offerings — requires a separate commercial license from Frumu LTD. See docs/LICENSING.md for the exact package-by-package terms.

Architecture

flowchart TD
    Human[Human operator or team]

    subgraph Entrypoints["Entrypoints: clients, not authority boundaries"]
        Desktop[Desktop app]
        Panel[Web control panel]
        TUI[Terminal UI]
        SDK[TypeScript / Python SDKs]
        Channels[Slack / Discord / Telegram]
    end

    subgraph Agents["Agents and models: propose, reason, draft"]
        Workers[Agent workers]
        Models[OpenAI / Anthropic / OpenRouterOpenCode Zen / Ollama]
    end

    subgraph Tandem["Tandem governed runtime: owns authority"]
        API[HTTP/SSE API]
        Tenant[Auth mode, tenant contextand authority chain]
        Projection[Authority projectionresources, grants, data classes]
        Runs[Sessions, workflowsautomations, context runs]
        Gates[Human approval gates]
        Policy[Tool and MCP policy]
        Memory[Permissioned memoryand company knowledge]
        Secrets[Provider and MCP secrets]
        Artifacts[Artifacts, validationand run evidence]
        Audit[Audit trail and tool ledger]
    end

    subgraph Systems["Company systems and data"]
        Workspace[Workspace files and repos]
        MCP[MCP servers and connectors]
        Data[Customer / company data]
        Browser[Browser and external tools]
    end

    Human --> Desktop
    Human --> Panel
    Human --> TUI
    Human --> SDK
    Human --> Channels

    Desktop --> API
    Panel --> API
    TUI --> API
    SDK --> API
    Channels --> API

    API --> Tenant
    Tenant --> Projection
    Projection --> Runs
    Runs <--> Workers
    Workers <--> Models

    Runs --> Gates
    Runs --> Policy
    Runs --> Memory
    Runs --> Artifacts
    Gates --> Audit
    Policy --> Audit
    Artifacts --> Audit

    Policy --> Secrets
    Policy --> Workspace
    Policy --> MCP
    Policy --> Data
    Policy --> Browser
    Memory --> Data

Common workflows

Features

Governed execution

• Model is not the control system: The model can propose work; Tandem owns the allowed tools, context, state transitions, approvals, and audit evidence.
• Scoped workflow execution: Automation V2 nodes can carry built-in tool and MCP connector policy so different steps see different capabilities.
• Approval-gated actions: Runs can halt before consequential work, wait for approve/rework/cancel decisions, and resume with recorded gate history.
• State Survival: Checkpoints, replayable event history, and materialized run states that survive API timeouts and connector failures.

Permissioned memory and company knowledge

• **Ten