import * as Card from '$lib/components/ui/card/index.js';
import Feature from '$lib/components/ui/feature.svelte';
import LiftoffCta from '$lib/components/ui/liftoff-cta.svelte';
import Braces from '@lucide/svelte/icons/braces';
import Plane from '@lucide/svelte/icons/plane';
import McpLogo from '$lib/components/icons/mcp-logo.svelte';
import Target from '@lucide/svelte/icons/target';
import RotateCcw from '@lucide/svelte/icons/rotate-ccw';
import KeyRound from '@lucide/svelte/icons/key-round';
<LiftoffCta />
## In flight
Once installed, one chained command takes you from zero to flying.
```sh
brew install --cask ALRubinger/aileron/aileron && \
aileron action add-suite github://ALRubinger/aileron-connector-google/suite.toml@latest && \
aileron launch claude
```
```
Creating a new Aileron vault.
Vault passphrase: ********
Trust publisher github://ALRubinger/aileron-connector-google? [y/N]: y
Authorize Google in your browser... done
✓ Installed 21 actions
✈️ Aileron — session 01HK6...
```
Claude Code now has twenty-one Google capabilities in its catalog, spanning Gmail, Calendar, Contacts, Drive, and Docs. Reads run silently when your agent reaches for them. Reversible writes (drafting an email, creating a calendar event, creating or editing a Doc, uploading or renaming a Drive file) run without prompting because the API itself provides the safety net. Irreversible writes (`send-email`, `send-draft`) and third-party-observable writes (`move-file`) pause for your approval — sent mail and a permission change aren't things you take back. Browse the full list in [Google](/actions/google/).
Aileron ships a Slack connector today alongside the Google catalog. Browse the full catalog in [Actions](/actions/google/).
## Put first principles back into AI
LLMs and AI agents excel at what they're built for: synthesizing information and proposing actions. They are not designed for consistency or precision.
The LLM may pick different tools each time you run the same prompt. A retry double-posts the announcement to `#engineering`. Inference may leak the secrets you let it touch.
Aileron adds three fundamentals of quality software to your agent.
<div class="not-prose grid gap-6 md:grid-cols-3 my-6">
<Feature icon={Target} title="Determinism">
**Predictability**. Same input, same output, every time. The action your agent runs today is the same action it runs tomorrow. No drift, no hallucinated arguments, no surprises.
</Feature>
<Feature icon={RotateCcw} title="Idempotency">
**Reliability**. Safe to retry. The network drops, you click approve twice, the system retries, and the action still runs once. You don't get two invoices, two emails.
</Feature>
<Feature icon={KeyRound} title="Security">
Your keys never reach the LLM. Gmail, Slack, and every other service live in a vault Aileron alone uses. The LLM sees results, not secrets.
</Feature>
</div>
The result: AI and traditional software each do what they're best at, in the same loop. Your agent proposes; Aileron executes. Your agent thinks fluidly; Aileron acts predictably.
## Discover what your agent can do
A few ideas that map to what Aileron ships today.
<div class="not-prose grid gap-4 md:grid-cols-2 my-6">
<Card.Root>
<Card.Header>
<Card.Title>Monday catch-up</Card.Title>
</Card.Header>
<Card.Content class="text-muted-foreground space-y-3">
_"Summarize what I missed over the weekend in `#engineering` and draft a reply to the thread about the migration."_
The agent calls `search-messages` and `list-channels` from the [Slack connector](/actions/slack/), synthesizes a summary, then proposes a reply. The approval card surfaces in your local webapp. You tap approve and Aileron posts as you through `send-message`.
</Card.Content>
</Card.Root>
<Card.Root>
<Card.Header>
<Card.Title>Reply triage</Card.Title>
</Card.Header>
<Card.Content class="text-muted-foreground space-y-3">
_"Draft replies to anything from a customer in the last 48 hours."_
The agent reads recent threads through the [Gmail connector](/actions/google/) and lands a draft in your Drafts folder via `draft-email`. Drafts are reversible, so this one's not gated. The existing "click Send in Gmail" step is the human review.
</Card.Content>
</Card.Root>
</div>
You could do this before. It was a lot of config to wire up. And you didn't, because you knew it was an unacceptable risk.
## Built to soar with Tools and MCP
Aileron doesn't replace Tool Calling or MCP. It complements them. Each layer in the agent stack owns a different job.
<div class="not-prose grid gap-6 md:grid-cols-3 my-6">
<Feature icon={Braces} title="Tool Calling">
How the LLM expresses tool intent. OpenAI's `tools` array, Anthropic's `tools`, the function-calling spec inside the LLM API.
</Feature>
<Feature icon={McpLogo} title="MCP">
How external tools and data get exposed to the LLM. A protocol for tool discovery and surfacing.
</Feature>
<Feature icon={Plane} title="Aileron">
How tool calls actually get executed. Deterministically, with sealed credentials, your approval, and a complete audit trail.
</Feature>
</div>
Your agent's existing MCP servers keep exposing tools the same way. The LLM still uses Tool Calling to express intent. Aileron is the layer that runs underneath, making the execution of those tool calls safe to use against your real systems.
## Where Aileron is today
The architecture above is real, shipped, and runs against real APIs. Three milestones anchor it:
- **[Milestone v1](https://github.com/ALRubinger/aileron/issues/493)** — First end-to-end install-and-execute path. A signed reference connector ([`aileron-connector-google`](https://github.com/ALRubinger/aileron-connector-google)) is installed by FQN, six Gmail and Calendar actions are bound to OAuth credentials in the local vault, and `aileron launch claude` runs the whole loop with sealed credentials, capability bounds, and audit emission. Ratified by 11 ADRs at [docs.withaileron.ai/adr](/adr/).
- **[Milestone v2](https://github.com/ALRubinger/aileron/issues/505)** — Personal-context demo for power users. Adds the spawn capability primitive ([ADR-0002](/adr/0002-connector-model/), [ADR-0014](/adr/0014-spawn-sandbox-technology/)) so sandboxed connectors can request the host to run a bounded local CLI subprocess. A native HTTP [Slack connector](/actions/slack/) ships in this milestone.
The [ADR index](/adr/) is the canonical record of every architectural decision that got us here.
## About
Aileron is an open-source project, stewarded by Andrew Lee Rubinger. Contact: [[email protected]](mailto:[email protected]).
[](https://github.com/ALRubinger/aileron)
