Roadmap

Roadmap

Agentoolbox ships in waves. This is a summary — the authoritative plan (design contract, current state, sequencing) lives in docs/ROADMAP.md.

Shipped (through Wave 4)

26 tools across 6 suites, exposed over REST + MCP + TypeScript SDK + Python SDK, with openapi.json as the machine contract.

• Wave 3 — Data & Validation: Identifier Validator, Schema Conformance, SQL Safety Gate.
• Wave 4 — Execution & egress gates: Command Safety Gate, URL / SSRF Gate.

Near-term — hardening

• main branch protection and immutable release tags (done).
• npm publishing via OIDC + signed --provenance.
• Certificate authenticity — move from integrity-only SHA-256 to a server-side signature (HMAC / Ed25519) plus a public verification path. Prerequisite for attest below.

Wave 5 — regulated verticals (proposed)

medcode (ICD-10 / CPT / HCPCS), tax (invoice + VAT/GST), trade & customs (HS / ECCN / denied-party), and extended legal citations.

Wave 6 — platform moat (proposed)

attest (signed, append-only transparency log), authz (deterministic RBAC/ABAC), budget (cumulative spend kill-switch).

How a tool graduates

See Contributing a Tool for the pipeline every wave item moves through before it ships.