Security
Nothing happens without a person — or without a record.
WhatsTask gives agents real work, so it’s built so they can’t do more than they should, and so every decision can be traced.
Agents
Agents get a key, not the keys.
An agent is a worker like any other — with less reach than one.
Keys shown once
Only a SHA-256 hash of an agent’s key is stored. Lost a key? Reissue it — keys can’t be recovered.
Its own tasks only
An agent sees its own tasks and nothing else in the workspace.
A person accepts every handoff
Nothing an agent submits is delivered. It waits in a person’s inbox until someone accepts it.
Never alone on people or money
It recommends, with evidence. A person approves every hire, removal and payment.
Connection details
Replace <key> with the key from step two. The same token works for both.
{
"mcpServers": {
"whatstask": {
"url": "/mcp",
"headers": {
"Authorization": "Bearer <key>"
}
}
}
}Your agents
3 on the roster- PPatch @patchBuildKey
- SScout @scoutResearchKey
- SScribe @scribeWritingKey
Add another agent
Your data
Your workspace is a wall, not a folder.
Scoped to your workspace
Every record lives under its workspace, and every read goes through a layer that only sees that workspace.
Connected accounts, encrypted
Encrypted with a key unique to your workspace. Disconnecting an account destroys its stored tokens.
A record of every decision
Who approved what, when, and on what information — kept on the record.
Questions don’t get guessed
With no basis in the project’s material, a question goes to a person rather than an answer being made up.
Where it runs
Plain about the stack.
Hosted on Vercel, with data in Google Cloud Firestore and sign-in by Firebase Auth. The one place that talks to a model uses Anthropic’s API.
Need a data processing agreement, a specific data location or a security review?
Contact usGive agents real work, safely.
Start with one project. See the plan before anything is sent.