Developers

Feature limits and mechanics

How each feature behaves under the hood: its limits, caps, timeouts and the rules it enforces.

Chat#

  • See every step the agent takes, tool-calls. A typed result view falls back to raw JSON when a payload does not parse. The live row shows a seconds counter once a step has run for five seconds.
  • Exact answers from real code, code-execution. Scripts run in a QuickJS WebAssembly sandbox with no filesystem or socket access. Every network request from a script routes through the curl tool with its credential and host checks. Each run stops at 30 seconds, caps its output at 1 MB and makes at most 50 nested tool calls. The sandbox loads Deno's @std packages, node:crypto, node:zlib and the vendored docx and fflate libraries. A skill's TypeScript scripts are type-checked when they are written.
  • The agent beside every page, chat-dock. The panel keeps its dragged width across pages and reloads. Option-Command-B on a Mac or Ctrl+Alt+B elsewhere opens and closes the panel. On a narrow screen a header button opens the chat as a full view with a back control to the page. The agent receives at most 2,000 characters of a selection and truncates anything longer. The open page reloads its data when a reply finishes, not while the reply streams.

Connectors#

  • Over 100 services ready to connect, connector-catalog. Search on Customize matches a connector's name or description and lists connectors ahead of other results while a query is typed. A refused registration shows the service's own reason rather than a generic failure.
  • Add any remote MCP server by URL, custom-mcp-servers. Ghostlyn tries an existing client for the same authorization server, then a client metadata document, then dynamic registration, and asks for manual credentials last. A scope the server does not advertise is rejected before saving. Connections use the MCP Streamable HTTP transport only, and the server's tools and UI resources sync into the connector on install. In production the URL must resolve to a public address and every redirect is checked, so a server on a private network is refused.
  • Read-only access until you allow changes, read-only-first. Gmail and Google Calendar upgrade by asking Google for wider scopes on the same OAuth app, while GitHub moves to a second GitHub App that can write. A connection whose token was revoked or rotated reads Needs reconnect.

Projects#

  • AGENTS.md as a project's instructions, agents-md. The root AGENTS.md arrives in the activation notice that loads the project, so the cached system prompt stays the same whichever projects a chat uses. An @path import is followed up to four levels deep. A subdirectory's AGENTS.md is added once per chat, the first time the agent reads or writes a file under it, labelled with the paths it governs.
  • A company wiki that cites its sources, wiki. Each ingest stores the fetched source unchanged under raw/, rewrites affected pages in place and logs every change in log.md. Lint checks source, concept, terminology, decision, citation and structure drift, plus pages past their review date or missing from index.md. A page's review date follows its volatility band, from 30 to 90 days for a tool or product page to 18 months for a principle. The wiki lives in a project you pick, and the skill refuses its own files, Home and temp as targets.
  • Two-way sync with a GitHub branch, github-sync. Pull mode polls the branch every five minutes and keeps the copy here read-only to editors and the agent. Two-way sync runs every minute and halts as Diverged when both sides changed a file, listing those files for an admin to resolve. A sweep sends pending pushes every minute, and a branch moved outside Ghostlyn marks a push remote as diverged.

Skills#

  • Skills in the open Agent Skills format, agent-skills. Every SKILL.md needs a description of at most 1,024 characters. A skill imported on its own needs a name of at most 64 characters that meets the spec's lowercase and hyphen rule. Only each skill's name and description sit in the prompt, and its SKILL.md body loads when the agent or a slash command invokes it. The user-invocable, disable-model-invocation, argument-hint and model fields decide who can invoke a skill, its slash hint and its model tier. The activate field preloads a skill. A GitHub pull skips a SKILL.md with invalid YAML or no description and lands the rest, while an import or an edit here refuses it outright.
  • Build a skill or an app by describing it, skill-builder. The scaffold writes a starter SKILL.md or app.tsx into the target project, and the create skill fills that file in place. Without a named target, a new skill saves to the loaded writable project that fits its topic, otherwise to Home, and the agent offers to move it. The optimize skill applies script extraction and table flag fixes directly, while a description rewrite or a body restructure waits for approval.
  • Import from GitHub, SKILL.md or zip, skill-import. An import takes up to 1,000 files and 32 MB in total, with no single file over 16 MB. A skill imported from a direct SKILL.md link needs a name in its frontmatter. A GitHub or zip import refuses two paths that differ only in letter case. A plugin's local-command server, its SSE server and its commands/, agents/ and hooks/ folders are listed in a notes toast after the import, since Ghostlyn does not run them.

Apps#

  • Full-page apps with the agent beside them, full-page-apps. An app needs a default UI entry to open at /apps/<slug>, so a project holding only inline widgets gets no sidebar link. The app frame reloads whenever its project's files or records change.
  • Interactive widgets inside chat replies, inline-widgets. A tool renders a widget by returning a ui:// resource, and bulk data under _meta.app reaches the iframe but never the model. Widgets load from a separate apps origin in a sandboxed cross-origin iframe, with a per-tool CSP listing the domains they may load from. The /widgets link from Slack and the CLI requires sign-in and opens only for the chat owner. A widget in a channel thread or a public share stays inline, since the full-screen page opens only for the chat owner.
  • Bar, line, area, pie and scatter charts, charts. The chart tool sends the rows to the widget while the model sees only the chart spec. A chart takes at most 500 rows, five series and 12 pie slices, and the agent aggregates rows before plotting. A scatter chart needs a numeric x column, and a pie splits one measure by x.

Tables#

  • Records the agent reads and writes, agent-records. Query filters rows by field with the operators ==, !=, >, >=, < and <=, sorts by one field and can return a count instead of rows. Save writes one record per call and merges the supplied fields into an existing record when the call names its ID. Remove takes explicit record IDs or a where filter and refuses a call with neither, so a malformed call cannot clear a table. Inline code has no owning item, so only a script saved to an item can reach that item's tables. In a channel or other shared conversation the agent refuses a built-in item's tables, which stay personal, and asks for a direct message instead.
  • Deleted records come back in a click, record-trash. A retention sweep purges trashed records once they are 30 days old. Revert matches rows by the exact time they were deleted, so a second Revert on the same call finds nothing to restore.
  • Ask about the row you selected, table-chat-context. The agent receives at most 2,000 characters of the selected row and truncates anything longer. The context names the open table and the selection, not the rows on screen, so the agent queries for anything else it needs.
  • One search box for everything, search-palette. Cmd+K, Ctrl+K or a slash typed outside a text box opens search from any page. The All tab shows three results per source, and a single tab loads 20 at a time as you scroll. Every tab carries an exact match count, including tabs with no matches.
  • Search by meaning, not just words, semantic-search. Matching by meaning runs only for queries of three or more words, on the All, Files and Chats tabs. Results combine full-text and embedding ranks by reciprocal rank fusion and drop embedding matches beyond a provider-specific distance threshold. The embedding request has a per-provider timeout, after which search answers from full-text matching alone.
  • Recall from past chats and channels, chat-recall. Recall ranks hits by combining full-text and embedding matches, with a recency boost that fades over about a month. A search returns 10 hits unless the agent asks for more. A channel attaching a project not shared with the member stays out of that member's results. A caller outside the organization's places searches personal chats only.
  • Reads pages that block bots, blocked-pages. A page behind a Cloudflare or DataDome bot challenge, or one that renders only in a browser, is refetched through Bright Data's unblocker in up to 45 seconds.

Voice#

  • A voice conversation with the agent, voice-mode. A session ends after two minutes of silence, five minutes in a background tab, 20 minutes in total or at the monthly usage limit. Control-Shift-V on a Mac or Alt-Shift-V elsewhere starts and ends a session from the composer. Spoken output appears as captions that stay in the thread, and the session's start time and length are recorded when it ends. A session started from a channel opens a new thread with its first request. A session in a channel, a direct message or a task chat speaks in the default voice rather than the member's chosen one.
  • Dictate a message instead of typing, dictation. Recording stops after 30 seconds of silence, 10 minutes in total or when the microphone disconnects. Holding Space starts dictation only when the message box is empty or the caret follows a space or a new line.
  • Listen to any reply, read-aloud. Sentence highlighting and click to seek work only when the speech provider returns timestamps.

Tasks#

  • Schedule work just by asking, schedule-from-chat. A recurring task runs at most every 15 minutes. A schedule follows the timezone the browser or Slack profile reports, or UTC when none is known. An unattended run that calls a send tool for a recipient outside its approved list is refused.
  • Background runs that report back, background-runs. A delegated run sees nothing of the chat that started it, so the agent hands it every fact it needs. A delegated run belongs to no task, so the Tasks page lists only scheduled and webhook work.
  • Full transcript for every run, run-transcripts. A run's transcript is read-only and stays for 30 days.
  • Start the agent from any other app, webhooks. The URL carries a 256-bit token shown once on the Tasks page and never in chat, and only its hash is stored. A request body over 64 KB is rejected with a 413. Each webhook starts at most 25 runs in any 24 hours. Each member holds up to 10 webhooks. A webhook run sends email or messages only to the recipients approved when it was set up.
  • Tasks the whole team shares, company-tasks. A company task runs as the organization agent and bills the organization's monthly budget rather than a member's. A company task run only reads from connected services and never writes to them. Attaching a project that someone watching the task cannot open is refused, naming who.

Documents#

  • Write and edit Word documents, word-documents. The agent builds a new document with the docx library inside its sandbox and never produces the older .doc format. In-place edits accept documents up to 2 MB with at most 4 MB of text markup, and a larger file is refused with the reason. Google Docs files belong to the Google Docs connector rather than the Word skill.
  • Undo any change the agent made, undo-changes. A change whose patch or removed content exceeds 100 KB carries no Revert control and is restored from the file's version history instead. A change already reverted is marked in the thread, and a second revert is refused.
  • Reads what is attached to your email, email-attachments. An attachment over 10 MB is refused. The Gmail connector reads attachments but cannot add one to a draft.
  • Attach a file to a message, chat-attachments. Each chat attachment can be up to 10 MB.

Sharing#

  • Share a chat or one answer, shared-chats. Viewers see each tool call's label and any widget, never its arguments, output, downloads or revert controls. An invite-only link shows nothing, not even the title, to anyone signed in with an address that was not invited.
  • Charts and tables on shared links, shared-widgets. A shared widget renders from its stored output, with no live tool call and no session. A shared widget offers no fullscreen control and no interaction that writes, since the viewer holds no session.
  • Share with people or groups, access-grants. Viewer reads, Editor writes and Admin manages grants, each set per person or per group. Sharing by email address works only for someone who already has a Ghostlyn account.
  • Request access to a teammate's project, access-requests. The owner's sharing page opens with the requester already selected at Viewer.

Team#

  • Web channels with a shared agent, web-channels. A public channel is open to everyone in the organization, and a private one only to the people added to it. A private channel goes public only once everyone in the organization can open the projects it uses. A mention bills the member who asked, and a reply the agent makes unprompted bills the organization agent. Without a mention, the agent considers replying only in a channel it answered in during the last 10 days or in a thread it already joined. A chat moved into a channel cannot be made private again. Forward copies a message from a chat, channel or direct message into another with a note and its author's card, warning when new people would see it. Agent replies show every tool call, and only the member whose turn raised a question card can answer it. Each member sets each channel to notify them on every message, on mentions and replies only or never. A channel manager edits its one-line description in place, and the Team page shows it too. Typing a slash lists only the skills the channel reaches and a hash only its projects, never a member's own.
  • Direct messages between people, direct-messages. Direct message on the Team page and Message in a channel's members list open the one direct message holding exactly those people. No admin outside a direct message can open, list or search it, and nobody can rename it, add people, archive it or leave it. In a direct message the agent replies only when mentioned, unless a member switches on Respond automatically.
  • Private drafts from your own accounts, private-drafts. One request per member waits in a chat at a time, and the agent does not guess the answer while it waits. The drafting run bills the member whose accounts it reads.
  • Ask what only a colleague knows, colleague-requests. A colleague can have at most three requests waiting on them, and a member can file at most 10 colleague requests in a rolling day. Asking the same colleague again in a chat while a request is open returns the open request rather than filing another. An approved answer posts as the colleague's own message, and the agent does not reply to it.
  • Members, team-members. Each member shows as active, inactive or still invited. One menu on the row makes a member an admin or takes the role back, and nobody can change their own. Deactivating blocks a person from the web app, Slack and the command line at once without deleting anything, and reactivating gives it all back. Removing a member deletes their work here, moves the bundles they shared to the organization and emails them.
  • Admin and member roles, admin-roles. The product refuses any change that would leave an organization with no admin, whether that is a role change, a departure or a deletion.
  • Invite by email, email-invitations. Invite a teammate on Settings, Organization reaches the invite form from a personal organization, and the first invitation turns it into a team with a shared organization project. An admin resends or revokes an invitation nobody has taken up yet. An unopened invitation stops working after a week, and resending it issues a fresh link with a fresh week. An address that already holds a membership here, or an invitation still open, is refused rather than invited twice.
  • Accept an invitation, invitation-accept. A link addressed to another email names that address and offers to switch accounts rather than joining as the wrong person. A link that has expired, been accepted already or leads somewhere the person already belongs says so plainly and offers the way on.
  • Groups, member-groups. Opening a group renames it in place and adds or removes people by searching the organization.
  • An audit log of who did what, audit-log. The log pages newest first, and each event carries the platform it came from. It covers joins, invitations, role changes, OAuth connections, credential changes, MCP client grants and tool calls, exports and shares. Chat titles never appear, and an export or share of a personal project or skill shows that it happened and when, never its name or path.
  • Take all your team's work with you, organization-export. Files keep their paths, each shared table exports as JSON and CSV, and manifest.json maps every project, skill and table to its owner. Chats, credentials, connected accounts and each member's private projects and skills, unshared rows and personal tasks stay out of the archive.
  • AI spend per member, with caps, organization-usage. Spend is read from the cost ledger alone and never from message content. A member filter narrows the same chart and range to one person's spend. The organization and each member show the share of their monthly limit used, with the date it resets. A member's limit defaults to 10 dollars a month, and the organization's to that default times its active members.
  • Choose your AI model provider, model-choice. The Models page appears to an admin only while the model_selection flag is on for the organization, and otherwise support switches the provider on request. Only providers whose keys the deployment holds are offered. Each provider maps a default, a fast and a slow model, and members pick Fast, Auto or Slow per chat. Embeddings stay on one provider across a switch, so search and chat recall keep working over existing history.
  • Approval before any change, tool-approval. Allow all stays the default, so every pilot and scheduled task keeps working as it does today unless an admin opts in. Sending an email or a chat message opens a confirm card bound to the exact call wherever a write would ask. A scheduled task, a webhook or a request from another agent stops at a write it cannot ask about and tells the owner what stopped it.
  • A second check on every change, tool-review. The review reads what a member or a scheduled task asked for and the pending call, never a tool's result. In a chat the confirm card leads with the reason a write was held, and a stopped task tells its owner why.
  • Per-tool permissions, tool-permissions. A member can make a tool stricter for themselves but never looser than the organization or its Tool approval allows. A blocked tool disappears from the agent, run scripts, MCP Apps and outside MCP clients alike.
  • Your place in a team, team-membership. Every account gets a personal organization of its own and can belong to any number of teams, each with separate chats, bundles and data. Leaving removes your chats, private bundles and credentials in that organization, and the bundles you shared stay with the team.

Slack#

  • The same agent in Slack DMs, slack-dms. The Slack app reads message text only, so files go to the agent through the web app. Past the message rate limit, an ephemeral note visible only to the sender says how many seconds to wait.
  • Answers in public Slack channels, slack-channels. It never runs in private channels or in Slack Connect channels shared with another company. A mention bills the member who asked, while an unprompted reply bills the organization. A Slack user with no Ghostlyn seat who mentions the agent is told an invitation is needed. Attaching a project to a channel waits for a project admin to confirm before its audience widens. A channel with no project attached runs on built-in skills, and the asker sees a note that an admin can attach some.
  • One identity across Slack and web, slack-and-web. A conversation started in Slack continues in Slack, so the web chat list holds only chats started there.

MCP#

  • Use Ghostlyn from Claude or ChatGPT, mcp-server. The scopes are records:read, tables:read, tables:write, volumes:read, volumes:write, web:fetch, skills:list, skills:invoke and agent:invoke. Calls are capped per minute and per hour for each member. The knowledge-first instructions go only to a client holding volumes:read, and the save guidance only to one also holding volumes:write.
  • Delegate to Ghostlyn from any AI, mcp-invoke. The invoke tool needs the agent:invoke scope. Each invoke turn counts against the member's monthly usage limit and message rate limit, and returns an error when either is reached. A chat ID resumes only a chat the same member started over MCP.
  • Serve one project to any assistant, mcp-per-project. The endpoint lives at /mcp/bundles/<slug> and serves tools under unprefixed names, and no page in the product links to it. Skill prompts need the skills:list scope, and table tools need tables:read or tables:write. A tool that needs approval under the organization's tool approval setting is refused, since an outside host cannot show the approval.

Account#

  • Developers page, developers-page. Every list on the page reads the code that owns it, so scopes, limits and sandbox modules match what ships. The same content answers as markdown at /developers.md or to a request accepting text/markdown.