AgentStack is the private registry and governance layer for the skills — and stacks of skills — your team and your agents run on.
A CLAUDE.md that was never checked into git. Someone's .cursor/rules on their laptop. A brand-voice.pdf buried in a drive. A pin in the #sales Slack channel. And skills installed straight from the open internet. Every one of them is shaping what your agents do — and none of them was reviewed.
No new runtime, no rip-and-replace. AgentStack sits above the agents you already run.
Package context, examples, and policies as a governed unit with one owner and one version.
Every upload is scanned for injection and secrets, then cleared by the gates a team requires — before it can ship.
Approved skills install into Claude Code, Codex, and your repos. Subscribe once; improve it for everyone at once.
The built-in security layer for all skills and stacks. It stops malicious agent instructions from reaching your team — prompt injection, hidden or override instructions, embedded secrets and credential paths, exfiltration paths, suspicious links, and over-broad tool use. On top of that, define custom gates for brand, legal, privacy, or anything unique to how a team works.
A private registry and governance layer for your organization's AI capabilities. Every skill and stack gets one owner, one approved current version, the gates it had to clear, and a full audit trail. AgentStack does not run your agents; it governs what they're allowed to follow.
A prompt library stores text for a person to copy and paste. AgentStack governs capabilities your agents install: every skill has an owner, a reviewed version, the gates it cleared, and an audit trail. Text in a doc has none of that.
Many instructions start there, and a repo can still be a source. But a file on one laptop isn't a governed answer for the whole organization. AgentStack sits above those sources and gives every team and runtime one owner, one current version, one review trail, and one place to install from.
Prompt injection, hidden or override instructions, embedded secrets and credential paths, exfiltration paths, suspicious links, and over-broad tool use — before any team gate begins. It's a security baseline, not a full security review, and it's actively expanding.
Wherever your agents already work. The CLI installs into runtimes like Claude Code and Codex, and into your repos; the Portal covers everyone else. The same approved skill lands in every target.
Every instruction your agents follow has an owner, a version, and a review behind it. Nothing reaches them unapproved.