You wouldn't let your AI agent do that. Now you can.

Liftoff in 5 minutes

Install Aileron, equip Gmail and Calendar actions, and launch Claude Code with everything wired in.

In flight

Once installed, one chained command takes you from zero to flying.

brew install --cask ALRubinger/aileron/aileron && \
  aileron action add-suite github://ALRubinger/aileron-connector-google/suite.toml@latest && \
  aileron launch claude

Creating a new Aileron vault.
Vault passphrase: ********

Trust publisher github://ALRubinger/aileron-connector-google? [y/N]: y
Authorize Google in your browser... done
✓ Installed 21 actions

✈️  Aileron — session 01HK6...

Claude Code now has twenty-one Google capabilities in its catalog, spanning Gmail, Calendar, Contacts, Drive, and Docs. Reads run silently when your agent reaches for them. Reversible writes (drafting an email, creating a calendar event, creating or editing a Doc, uploading or renaming a Drive file) run without prompting because the API itself provides the safety net. Irreversible writes (send-email, send-draft) and third-party-observable writes (move-file) pause for your approval — sent mail and a permission change aren’t things you take back. Browse the full list in Google.

Aileron ships a Slack connector today alongside the Google catalog. Browse the full catalog in Actions.

Put first principles back into AI

LLMs and AI agents excel at what they’re built for: synthesizing information and proposing actions. They are not designed for consistency or precision.

The LLM may pick different tools each time you run the same prompt. A retry double-posts the announcement to #engineering. Inference may leak the secrets you let it touch.

Aileron adds three fundamentals of quality software to your agent.

Determinism

Predictability. Same input, same output, every time. The action your agent runs today is the same action it runs tomorrow. No drift, no hallucinated arguments, no surprises.

Idempotency

Reliability. Safe to retry. The network drops, you click approve twice, the system retries, and the action still runs once. You don’t get two invoices, two emails.

Security

Your keys never reach the LLM. Gmail, Slack, and every other service live in a vault Aileron alone uses. The LLM sees results, not secrets.

The result: AI and traditional software each do what they’re best at, in the same loop. Your agent proposes; Aileron executes. Your agent thinks fluidly; Aileron acts predictably.

Discover what your agent can do

A few ideas that map to what Aileron ships today.

Monday catch-up

“Summarize what I missed over the weekend in #engineering and draft a reply to the thread about the migration.”

The agent calls search-messages and list-channels from the Slack connector, synthesizes a summary, then proposes a reply. The approval card surfaces in your local webapp. You tap approve and Aileron posts as you through send-message.

Reply triage

“Draft replies to anything from a customer in the last 48 hours.”

The agent reads recent threads through the Gmail connector and lands a draft in your Drafts folder via draft-email. Drafts are reversible, so this one’s not gated. The existing “click Send in Gmail” step is the human review.

You could do this before. It was a lot of config to wire up. And you didn’t, because you knew it was an unacceptable risk.

Built to soar with Tools and MCP

Aileron doesn’t replace Tool Calling or MCP. It complements them. Each layer in the agent stack owns a different job.

Tool Calling

How the LLM expresses tool intent. OpenAI’s tools array, Anthropic’s tools, the function-calling spec inside the LLM API.

MCP

How external tools and data get exposed to the LLM. A protocol for tool discovery and surfacing.

Aileron

How tool calls actually get executed. Deterministically, with sealed credentials, your approval, and a complete audit trail.

Your agent’s existing MCP servers keep exposing tools the same way. The LLM still uses Tool Calling to express intent. Aileron is the layer that runs underneath, making the execution of those tool calls safe to use against your real systems.

Where Aileron is today

The architecture above is real, shipped, and runs against real APIs. Three milestones anchor it:

Milestone v1 ↗ — First end-to-end install-and-execute path. A signed reference connector (aileron-connector-google ↗) is installed by FQN, six Gmail and Calendar actions are bound to OAuth credentials in the local vault, and aileron launch claude runs the whole loop with sealed credentials, capability bounds, and audit emission. Ratified by 11 ADRs at docs.withaileron.ai/adr.
Milestone v2 ↗ — Personal-context demo for power users. Adds the spawn capability primitive (ADR-0002, ADR-0014) so sandboxed connectors can request the host to run a bounded local CLI subprocess. A native HTTP Slack connector ships in this milestone.

The ADR index is the canonical record of every architectural decision that got us here.

About

Aileron is an open-source project, stewarded by Andrew Lee Rubinger. Contact: [email protected].

↗