Tracebind — Audited infrastructure your agent can actually deploy.

The problem

Every team eventually hits the same wall.

A SaaS your business depends on has no usable API. The work only happens in the UI. Sales just promised the integration to close the deal. Or worse — the agent you shipped needs to call it, and "browser in the loop per action" is 100× too slow.

The repeat offenders are vertical SaaS — procurement portals, broker dashboards, legacy HR, healthcare clearinghouses, freight TMS, mid-market ERPs. The real workflow exists only in the browser.

The current options are a brittle Playwright script that breaks on every CSS change, an RPA contract, a five-figure connector tax, a scraper that you can't ship past a security review, or giving up. Tracebind replaces the first four.

You log into the app the way you normally would. Tracebind captures the traffic, clusters the endpoints, infers path parameters, and emits an OpenAPI 3.1 spec, a typed SDK in TypeScript and Python, and an Anthropic MCP server. Every session is tagged with a named operator and anchored to ArmoredLedger as a signed, content-addressable receipt chain.

// today's options

brittle Playwright script

RPA shop contract

$50K/yr connector tax

stealth scraper, no SOC 2

give up; do it by hand

→ tracebind capture · compile · sign

How it works

Three deterministic stages. No model in the loop.

Tracebind is a compiler, not a generator. The spec is derived from observed wire traffic — when it says a field is a string, the server sent a string. Every output is byte-reproducible from the same input session.

01 · CAPTURE

Capture

A named operator drives an authorized Playwright session inside a hardened Voltainer container. Every HTTP request and response is captured at the network layer with headers, status, timing, and body samples. Sensitive headers are stripped at write time.

network.jsonl └── 1,427 entries ├── 318 GET /api/v3/customers/... ├── 211 POST /api/v3/invoices └── 898 other

02 · COMPILE

Compile

Path-clustering groups requests by structural pattern, collapsing /customers/c_8H2k9F and /customers/c_4Lp1Aq into /customers/{customerId}. Query parameters are typed from observed values; response shapes inferred conservatively.

clusters: 47 └── 12 with path params ├── {customerId} ^c_[A-Z0-9]{6}$ ├── {invoiceId} ^inv_[0-9]{8}$ └── ...

03 · REGISTRY & AUDIT

Registry & audit chain

The OpenAPI document, SDK tarballs, and MCP server are published to the tenant's two-bucket registry — private by default, public when you mean it. Every push, every signed-URL issuance, every pointer rebind emits an ArmoredLedger receipt the auditor can verify.

→ openapi.json 47 ops · signed → sdk-ts/ 12 modules → sdk-py/ 12 modules → mcp-server.tar.gz registered → AL receipts chain intact

Why Tracebind

Five things no one else credibly says.

Most of the category sells stealth, residential proxies, and detection-evasion. We do not. The refusal is the product.

01 · DETERMINISTIC

Compiled, not generated.

The spec comes from real wire traffic. No LLM guessing whether a field is nullable. Same input session, byte-identical output, every run.

02 · LOCAL-FIRST

No traffic leaves your network.

Tracebind runs on your hardware. Captures stay on disk. No telemetry, no centralized credential store, no "let us host your sessions for you."

03 · AUDITED BY CONSTRUCTION

Named operators. Append-only ledger.

Every session has a named operator_id. Every push, every signed-URL issuance, every pointer rebind lands as a signed ArmoredLedger receipt. SOC 2 evidence falls out by default.

04 · NO STEALTH

The repo lints against it.

No captcha solvers. No residential proxies. No detection-evasion. Only systems the operator is authorized in. Refusal is in the license, the code, and the conversational layer.

05 · HARDENED RUNTIME

Built on the stack we ship.

Tracebind runs on Voltainer and systemd-nspawn — the hardened container platform ArmoredGate sells to enterprise. We dogfood the deployment story.

For the agent stack

Compile a SaaS into an agent tool. Without the audit-chain compromise.

Every Tracebind output ships an @modelcontextprotocol/sdk-pinned MCP server. Drop it into Claude Desktop, Cursor, or Devin — one tool per endpoint, auth via environment, operator-tag enforced. The conversational layer is Tessera: precise, dry, principled. It will not bypass the ledger.