Product How it works Use Cases Pricing Docs Book a call

From a plain-English request to a governed interface change

Every edit, human or agent, follows the same four stages.

1
Describe the change

Typed in chat, or called by an agent over MCP.

2
Plan against the Manifest

Checked against your declared Entities, Actions, and Regions.

3
Execute in an isolated sandbox

Isolated QuickJS-WASM. 1,000ms timeout, 16MB memory cap.

4
Commit as a reversible overlay

A structured diff against the Manifest — not a text patch.

Reconcile, don't overwrite

Every overlay reconciles automatically against a new Manifest — a three-way merge, never a silent overwrite.

overlay-engine reconcile.ts
1const result = await engine.reconcile(
2 userOverlay, manifestV2_5
3);
4
5// conflicts: [] — clean, idempotent merge
6store.save(result.rebasedOverlay);

Never silent data loss — just a typed conflict

Conflict
Collision

Same field, changed by both sides.

Conflict
Concurrent modification

The base moved before the merge.

Conflict
Dangling reference

Points at something that's now gone.

Conflict
Removed upstream

The vendor removed what it touched.

Every action is governed

hash-chained
Tamper-evident audit log

Each entry hashes the one before it.

policy gate
Approval before execution

High-impact actions wait for a human.

per-tenant
Scoped by design

No shared state between tenants.

Twelve subsystems, one install

One executor interface is all you write.

PackageSubsystemWhat it does
manifest-schemaManifest schema & derivationAuto-derivable from an OpenAPI spec.
sandbox-runtimeQuickJS-WASM sandboxNo filesystem, network, or process access.
overlay-engineStructured diff & reconciliationThree-way merge against the current Manifest.
governance-engineAudit & policyHash-chained log, plus an approval gate.
mcp-serverNative MCP exposureOne MCP tool per declared Action.
mcp-clientOutbound MCP integrationMerges external MCP tools into the Manifest.
chat-sdkEmbeddable agent loopThe composer your users type into.
genui-runtimeGenerated UI, sandboxedIsolated iframe, zero network egress.
automationDurable workflowsSame sandbox and governance path.
voiceGoverned voice sessionsEphemeral credentials, a governed tool-call bridge.
sqlite-storeDurable persistenceSwappable for Postgres at scale.
vendor-sdkOne install, framework-neutralinitBrimeo() wires it all behind one call.
Built on the protocols agent teams already use
MCP OpenAPI 3.0 QuickJS / WASM SQLite

Does Brimeo ever see or store our source code?

No. It only calls the Actions you declare — never reads or stores your codebase.

What actually runs the code an agent generates?

A QuickJS-WASM engine — no network, filesystem, or Node access, disposed after every run.

Can a customization silently break when we ship a release?

No. It's always a clean merge or a typed conflict — never a silent partial change.

Is every change actually reversible?

Every change is a structured, editable overlay. It can't un-execute a write your backend already committed — and never claims to.

Do we need to rebuild our product to use Brimeo?

No. One executor interface maps to your existing backend — proven against both a Node and an edge host.

See it running against your own Manifest

Bring an OpenAPI spec, or a sketch of your Entities and Actions — we'll run a real sandboxed edit live.

Book a call Explore the product