Every software has an API.Yours just isn’t public — yet.
Foral watches how your app talks to its own backend — with your authorization — and distills it into a contract: declarative, versioned, fingerprinted. Your agents get typed capabilities over MCP. No browser puppeteering. No generated code that rots.
How it works
Record — with authorization
A human signs in to the real system (the password never touches Foral) and navigates. Foral observes the app’s own network conversation.
Contract — not code
The observation becomes a declarative contract: routes, typed fields, identity, pagination, write rules. Versioned, fingerprinted, refused at load if invalid.
Serve — as MCP
One command exposes the contract as an MCP server. Claude, or any MCP client, sees typed tools — and never needs to know there was no public API.
The whole interface is this file
A contract is a few dozen lines of declarative YAML — versioned, fingerprinted, refused at load if invalid. No SDK lock-in, no generated code to maintain. Reads are free; the write below is born disabled until a human approves that exact sentence.
system: DEMO
contract_version: 1
domains: [app.example.com]
auth: { type: cookie, login_url: https://app.example.com/login }
capabilities:
- name: list_items
mode: network_json
route: /api/items
list: true
cursor: page
source_id: id
extractors:
- { field: id, path: items[].id }
- { field: title, path: items[].title }
- name: move_item
mode: playwright_action
scope: write
hitl: true
parameters: [id, status]
confirmation: Move item {id} to "{status}"?
The full contract specification ships with the public sandbox.
The floor is inviolable
Governance is not a feature tier. It is the material the engine is built from.
Fail-closed by construction
No allowlist, no boot. Wildcards refused. Invalid contracts refused at load — never mid-execution.
The password never transits
Sign-in happens on the target system’s own form, by a human. Foral stores only the encrypted session — verified mechanically in our test suite.
Writes are born disabled
Every write capability requires a declared human-approval gate and the exact sentence the approver reads. No gesture, no write.
Alarms, not silent corruption
Every response is checked against the contract’s fingerprint. If the source changed shape, you get an alert — never quietly wrong data.
Tenant-signed boundary
Every call is HMAC-signed with the tenant inside the signature. Sessions are encrypted at rest. No key, no operation.
Your data stays yours
The engine holds no customer data. Contracts carry shape, not values. Reads execute on your side of the wall.
A contract that stays alive
Generated integration code rots in silence. A Foral contract is maintained — with proof.
- The fingerprint flags the change before wrong data can enter.
- A new contract version is proposed automatically.
- It is promoted only after being proven against known-good history — you are notified with the scorecard, not consulted.
- Below the proof threshold it fails closed: capability marked, old data flagged stale. Nothing corrupts.
- A fix for one system benefits every instance of that system.
Measured, not promised
Numbers from a real production system (a Brazilian vertical ERP with no public API), August 2026, anonymized.
read capabilities + human-gated writes, mapped in one authorized evening
items mirrored across 10 states — second sweep: zero drift, fully idempotent
per read — plain HTTP with the saved session. No browser in the hot path
tests guarding the engine — every wall in this page exists as a failing test first
status · aug 2026 — engine proven against a live production ERP · contract spec v1 in internal review · public sandbox in progress
Against everything else on the table
Code generated once rots silently. A contract alarms, heals with proof, and keeps an audit trail.
A recorded skill remembers the path and replays it with an agent — probabilistically. A contract guarantees the result — deterministically.
Impressive on benchmarks; your operations run 96 times a day and need 100%, milliseconds, and an audit trail — not minutes and a maybe.
Their catalog covers popular sites. Foral covers your system — the vertical ERP nobody else maps — under your authorization.
Questions we actually get
Is this scraping?
No. Foral reads the same internal API your app’s own frontend uses, under your credentials and your authorization, on your infrastructure. It is your system, reached through another door — the customer-authorized posture pioneered in open finance.
What happens when the vendor changes the system?
The contract’s fingerprint raises an alarm before wrong data enters. A new version is proposed and only promoted with proof against known-good history. Breaks are rare, visible and short — and never corrupt.
Can the agent do something I didn’t approve?
No. Agents act only through capabilities declared in the contract. Writes are born disabled and require a human gesture on the exact sentence declared in the contract. Free-browsing an authenticated session is vetoed by design.
Does my data pass through Foral’s cloud?
No. Values stay on your side; reads execute with your saved session on your infrastructure. The engine and contracts carry shape, not customer data.
What if the vendor ships an official API?
The contract migrates its transport underneath — your agents keep calling the same capabilities. Foral is pro-ecosystem: official APIs are an upgrade, not a threat.
When can I use it?
We are onboarding design partners now. Request early access and tell us which system you need charted.
Chart your first system
We are selecting design partners with real systems and real operations. Tell us what you run.
founders@foral.devWhen you email us, we use your address only to reply. Privacy Policy