Built For Engineers

The surface you'll actually touch

A workflow, an API call, a tool registration — pick your entry point.

Everything in BfxOS is reachable the way you'd expect: REST for triggering and streaming, a standard registration shape for tools. Illustrative examples below — see the full API reference for exact contracts.

# Kick off a pipeline run — auth, input, done.
curl -X POST https://your-org.bfxos.ai/api/pipelines/expense-review/run \
  -H "Authorization: Bearer $BFXOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input": {"document_url": "s3://finance/inv-4821.pdf"}}'

# Server-Sent Events — watch a workflow as it actually runs.
curl -N https://your-org.bfxos.ai/api/workflow/wf_9f21/stream \
  -H "Authorization: Bearer $BFXOS_TOKEN"

event: log      "Fetching document..."
event: status   "running"
event: done     {"output": "...", "tokens": 1842, "cost_usd": 0.014}

// Register an internal tool once — every agent can reach it.
{
  "name": "internal-crm-lookup",
  "transport": "mcp",
  "endpoint": "https://tools.internal.corp/mcp",
  "scopes": ["read:accounts"],
  "auth": { "type": "vault_secret", "ref": "crm-service-token" }
}

Illustrative — exact request/response shapes live in the API reference, not reproduced here.

What you get

The infrastructure decisions you'd otherwise make yourself.

Model Router

Provider and model are config, not code — swap Anthropic for Azure OpenAI or a local model without touching a workflow definition.

MCP Servers

Standards-based tool access — register a tool once, every agent and Crew can reach it, no one-off SDK per integration.

Repo Intelligence

An agent that understands a codebase well enough to work in it safely — not a chat window pointed at a directory listing.

Observability & LLM Ops

Every run, every model call, every prompt version — traced and diffable, the way you'd expect from production software.

Secret Vault

Credentials encrypted, scoped, and delegated — an agent gets a reference, never a raw key pasted into a prompt.

API Endpoints

Any Pipeline or Crew is a callable API from day one — build the workflow once, call it from wherever you already ship.

Runs where you need it

SaaS today. Self-hosted the moment you need it.

No rip-and-replace, no re-platforming your workflows to move.

Deployment paths

Docker Compose for a single instance, Kustomize-based manifests from a Docker Desktop cluster through to production Kubernetes on your own cloud — the same workflow definitions, unchanged.

Docker ComposeKubernetesAzureAWS

No provider lock-in

The Model Router dispatches across providers by config — swap or mix them per workflow, per team, or per compliance requirement, without a migration project.

AnthropicOpenAIAzure OpenAIOpen-source / local

Questions we get first

The stuff you'd ask before a pilot.

Q.Can we self-host, fully?

Yes — Docker Compose for a single instance, or Kubernetes (Docker Desktop through to production cloud) via the same Kustomize manifests. Your data, your cluster.

Q.Are we locked into one model provider?

No. The Model Router routes per request across Anthropic, OpenAI, Azure, and open-source models — provider and model are configuration, not something baked into a workflow.

Q.How are secrets handled?

Through the Secret Vault — encrypted at rest, scoped per user or team, and delegated with expiry. An agent references a secret; it never sees the raw value in a prompt.

Q.Can we see exactly what an agent did?

Yes — every run, every model call, and every decision is logged and auditable through Observability and the governance dashboard, not just a final output.

Built for how you actually work.