Primitives

The 6 building blocks of every Agent OS agent.

💾mem🗂️fs🗄️db🌐net⚙️proc📡events

💾

mem — Memory Cache

Sub-millisecond key-value storage with TTL, backed by Redis.

Backed by: Redis Cloud

• Keys are automatically namespaced to your agent — no key collisions between agents.

• Memory quota tracked via Redis. Default: 100 MB per agent.

mem_set→ true

Store a value with optional expiry.

keystringrequiredCache key (namespaced per agent)

valueanyrequiredValue to store (serialized to JSON)

ttlnumberoptionalSeconds until expiry (omit for no expiry)

mem_get→ value or null

Retrieve a value by key.

keystringrequiredCache key

mem_delete→ true

Delete a key.

keystringrequiredCache key to delete

mem_list→ string[]

List all keys with an optional prefix.

prefixstringoptionalFilter keys by prefix

mem_incr→ new value (number)

Atomically increment a numeric key.

keystringrequiredKey to increment

amountnumberoptionalIncrement by (default 1)

mem_expire→ true

Update the TTL of an existing key.

keystringrequiredKey to update

ttlnumberrequiredNew TTL in seconds

🗂️

fs — Filesystem

Cloud file storage with per-agent isolation, backed by Supabase Storage.

Backed by: Supabase Storage (S3-compatible)

• All paths are isolated per agent — /data/file.txt for agent A is different from /data/file.txt for agent B.

• Default storage quota: 1 GB per agent.

• File data is base64-encoded in transport. Use Buffer.from(data, "base64") in Node.js.

fs_write→ { path, size_bytes }

Write a file (base64 encoded content).

pathstringrequiredFile path e.g. /data/report.json

datastring (base64)requiredFile content encoded as base64

contentTypestringoptionalMIME type e.g. application/json

fs_read→ { data (base64), contentType, size }

Read a file (returns base64 encoded content).

pathstringrequiredFile path to read

fs_list→ { files: [{ name, path, size, contentType }] }

List files in a directory.

pathstringrequiredDirectory path e.g. /data/

fs_delete→ true

Delete a file.

pathstringrequiredFile path to delete

fs_mkdir→ true

Create a directory marker.

pathstringrequiredDirectory path

fs_stat→ { path, size_bytes, contentType, created_at, updated_at }

Get file metadata.

pathstringrequiredFile path

🗄️

db — Database

Full PostgreSQL with per-agent schema isolation. Run real SQL queries safely.

Backed by: Supabase (PostgreSQL 15)

• Each agent gets a private PostgreSQL schema (agent_{agentId}). No cross-agent access.

• All queries are parameterized — SQL injection is not possible.

• pg_catalog, information_schema, and system tables are blocked.

db_create_table→ true

Create a new table in the agent's schema.

tablestringrequiredTable name (alphanumeric + underscore)

schemaarrayrequiredColumn definitions [{column, type, primaryKey?, nullable?}]

db_insert→ inserted rows

Insert one or more rows.

tablestringrequiredTable name

dataobject | arrayrequiredRow data or array of rows

db_update→ number of rows updated

Update rows matching a condition.

tablestringrequiredTable name

dataobjectrequiredFields to update

whereobjectrequiredWHERE clause {column: value}

db_delete→ number of rows deleted

Delete rows matching a condition.

tablestringrequiredTable name

whereobjectrequiredWHERE clause {column: value}

db_query→ query results array

Run a parameterized SQL query.

sqlstringrequiredSQL query with $1, $2 placeholders

paramsarrayoptionalParameter values for placeholders

db_transaction→ array of results

Execute multiple SQL statements atomically.

queriesstring[]requiredArray of SQL statements

🌐

net — Network

Outbound HTTP with SSRF protection and domain allowlisting.

Backed by: Direct HTTP (SSRF-protected)

• Private IP ranges are blocked (10.x, 192.168.x, 127.x, 172.16–31.x, 169.254.x).

• Cloud metadata endpoints are blocked (metadata.google.internal, etc).

• HTTPS is required for all requests.

• Domain allowlisting can be configured per-agent or globally.

net_http_get→ { status, headers, body }

Make a GET request to an external URL.

urlstringrequiredFull URL (must be HTTPS)

headersobjectoptionalCustom request headers

net_http_post→ { status, headers, body }

Make a POST request.

urlstringrequiredFull URL

bodyanyrequiredRequest body

headersobjectoptionalCustom request headers

net_http_put→ { status, headers, body }

Make a PUT request.

urlstringrequiredFull URL

bodyanyrequiredRequest body

headersobjectoptionalCustom request headers

net_http_delete→ { status, headers, body }

Make a DELETE request.

urlstringrequiredFull URL

headersobjectoptionalCustom headers

net_dns_resolve→ string[] of IP addresses

Resolve a hostname to IP addresses.

hostnamestringrequiredDomain name to resolve

⚙️

proc — Process

Sandboxed code execution for Python, JavaScript, and Bash.

Backed by: Isolated subprocess + temp directory

• Processes run in an isolated temp directory. No access to host filesystem.

• Output (stdout/stderr) is limited to 1 MB per stream.

• Timeout default is 30 seconds; can be up to 5 minutes (300,000 ms).

proc_execute→ { stdout, stderr, exitCode, duration_ms }

Execute code in a sandboxed process.

codestringrequiredSource code to execute

languagestringrequired"python" | "javascript" | "bash"

timeoutnumberoptionalMax execution time in ms (default 30000, max 300000)

envobjectoptionalAdditional env vars to inject

proc_schedule→ { taskId, nextRunAt }

codestringrequiredCode to run

languagestringrequiredLanguage

cronExpressionstringrequiredCron expression e.g. "0 * * * *"

proc_spawn→ { processId }

Spawn a child agent for a task.

agentIdstringrequiredChild agent ID to activate

proc_kill→ true

Kill a running process or disable a scheduled task.

processIdstringrequiredProcess/task ID to kill

proc_list→ { processes: [...], scheduledTasks: [...] }

List recent processes and scheduled tasks.

📡

events — Events

Redis-backed pub/sub messaging for agent coordination.

Backed by: Redis pub/sub

• Topics are private by default — only your agent can publish/subscribe.

• Public topics enable cross-agent coordination.

events_publish→ true

Publish a message to a topic.

topicstringrequiredTopic name

messageanyrequiredMessage payload

isPublicbooleanoptionalAllow other agents to subscribe (default false)

events_subscribe→ message[]

Get recent messages from a topic.

topicstringrequiredTopic to read

sincestring (ISO)optionalOnly messages after this timestamp

events_unsubscribe→ true

Remove a subscription from a topic.

topicstringrequiredTopic to unsubscribe from

events_list_topics→ string[]

List all topics the agent has subscribed to.