AI teammate for your whole team

An AI teammate for Slack that can actually reach your systems.

Mention it in a thread and it reads the history, searches your documents and the web, and queries GitHub, Sentry, ClickUp or any MCP server. It can reach your systems — it just can’t hold the keys: credentials are injected outside the model, every write waits for a human, and it runs on whichever model you point it at.

Book a demo See how a write is held

eng-oncallthread

Sam9:12 AM

@attest_tag checkout errors are up since this morning’s deploy — what changed?

attest_tagApp9:12 AM

read_thread →sentry_issuesgithub_get_pr

Two things landed at 08:40 UTC. Sentry opened a new group one minute later — TypeError: cannot read ‘currency’ — 412 events, all on POST /checkout/confirm.

That is the same minute #2841 “drop legacy currency fallback” merged. The PR removes the ?? "USD" default in priceFor(), and three call sites still hand it a cart with no currency set.

Want me to fix it and raise a PR?

z-ai/glm-5.3-flash3.4k in512 out$0.0021Configure

attest_tagApp10:04 AM

read_thread →drive_searchnotion_pages

Prorated. Handbook §4.2, “Leave carry-over” accrues days monthly from the start date, so a 15 September start carries 7.5 days into next year rather than the full 20.

One exception, in people-ops/transfers.md: a move from another entity keeps its original start date. This is an external hire, so it does not apply.

Accrual table for their first year: carry-over-2026.csv — and the clause it comes from, Handbook §4.2.

z-ai/glm-5.3-flash2.9k in318 out$0.0014Configure

attest_tagApp2:41 PM

read_thread →stripe_chargesclickup_task

The card is fine. Three charges on acct_4471 failed with authentication_required — Stripe asked for 3-D Secure and our retry job drops the confirmation URL.

They start 6 August, the day billing-api v2.31 shipped the new retry path. SUP-3104 already has two more accounts failing exactly the same way.

All three charges and the two other accounts are on the ticket: SUP-3104.

z-ai/glm-5.3-flash3.1k in402 out$0.0018Configure

attest_tagApp9:30 AM

read_thread →gcp_billingdatadog_metrics

Almost all of it is one line — egress from europe-west1, $6,910 against $410 in July. Compute is flat.

It steps on 22 July, when the image service began serving originals from the EU bucket to a US CDN. Datadog shows the same step in cdn.origin.bytes to the hour.

Here is the breakdown as a sheet, split by day and by service: gcp-egress-august.csv.

z-ai/glm-5.3-flash3.6k in356 out$0.0017Configure

attest_tagApp4:15 PM

read_thread →hubspot_dealsdrive_search

Six, worth $412k. Four moved for one reason: security review is the stage each is sitting in, 24 days on average.

The other two — Arbor Health and Lumen Retail — moved after a budget freeze, noted in the call summaries in Drive rather than on the deal itself.

All six, with the stage and the days in it: q3-slipped-deals.csv.

z-ai/glm-5.3-flash4.0k in388 out$0.0019Configure

attest_tagApp9:12 AM

read_thread →sentry_issuesgithub_get_pr

Two things landed at 08:40 UTC. Sentry opened a new group one minute later — TypeError: cannot read ‘currency’ — 412 events, all on POST /checkout/confirm.

That is the same minute #2841 “drop legacy currency fallback” merged. The PR removes the ?? "USD" default in priceFor(), and three call sites still hand it a cart with no currency set.

Want me to fix it and raise a PR?

z-ai/glm-5.3-flash3.4k in512 out$0.0021Configure

One mention. Two services queried, the credentials for both injected outside the model, and the whole turn priced at two tenths of a cent.

Connects to

+ more

MCP serverHTTPS API

What it does

A teammate, not a search box.

It remembers what you told it, runs on a schedule, writes files, reaches your services, and knows what it is not allowed to do on its own.

In the thread

Threads & streaming

Answers stream in while a status line says what it is doing. Say “stop” and the model call and every tool in flight are cancelled.

Slack tools

Thread and channel history with names resolved, workspace search, channel lists, pins, user lookup.

Your documents

Chunked, embedded and searched. Ask a policy question and it answers only from what you indexed — and names the page.

Web search & fetch

Search and page fetch with an SSRF guard: no private, loopback or link-local hosts, no non-HTTP schemes.

Files & artifacts

Reads PDFs and text you attach. Ask for something as a file and it writes one, uploads it, and keeps it in the console.

Commands

!help, !usage, !model, !memory, !routines, !jobs, !mute — handled before anything reaches the model.

Reaching out

Connections

One credential for one service, scoped to the channels you choose, with allowed hosts, paths and methods.

Bundles & presets

Group connections, instructions and skills, then attach them to a channel. Presets for a dozen services fill in the details.

Credential proxy

The model emits a URL. The proxy matches it, injects the secret at the edge, and scrubs it back out of the response.

Remote MCP servers

Point at an MCP server and its tools load on demand — not 20k tokens of definitions on every round. Bearer or OAuth.

Repositories & fix jobs

Connect a repo, then say “fix this and raise a PR”. A worker container does it and opens a draft.

Memory & routines

“Remember for this channel…” and “every weekday at 9am…”, in plain sentences, stored per channel.

Running it

Admin console

Scopes, bundles, documents, memory, routines, jobs, artifacts, activity and settings — served by the binary itself.

Approvers & roles

Approval tiers that name the bundle their members may grant from, plus admin, editor and viewer in the console.

Budgets & limits

A monthly cap for the workspace, another per channel, and a per-user hourly rate limit. It pauses rather than surprises.

Audit trail

Every turn, tool call, proxied request and completion — with tokens and cost — stored and exportable as CSV.

Model routing

A cheap default, a heavy model for code and long threads, a vision model for images, and per-thread overrides.

Scheduled digests

Routines run in a fresh thread on cron, in your timezone, and edit their own post with the result.

The core loop

Ask, reach, hold, ship.

The same four beats on every turn, whether the answer is a sentence or a pull request.

01Ask

Mention it in the thread you were already having.

It rebuilds the whole thread on every turn, so edits and deletions are noticed. Follow-ups need no mention. Attached files and PDFs are read into context, and long threads are windowed with a running summary rather than truncated.

people-opsthread

Mei4:07 PM

@attest_tagwhat’s our policy on carrying leave into the next year? check our docs

attest_tagApp4:07 PM

Up to 5 days carry into Q1 and expire on 31 March. Anything above 5 needs your manager’s sign-off before 15 December, and contractors are out of scope entirely.

Employee handbook§4.2 Annual leave
2026 policy updateCarry-over changes

Answered only from what you indexed — and it says which page.

02Reach

It looks things up in the systems that hold the answer.

Slack history and search, your indexed documents, the web, and any service you have connected — GitHub, ClickUp, Sentry, Jira, Notion, Stripe, or a remote MCP server. It says which tool it is running while it runs.

support-escalationsthread

Dan2:41 PM

@attest_tag the Vasquez account is still on the old plan — can you bump their seat count to 40 and note it on the ticket?

attest_tagApp2:41 PM

Found them: acct_8813, Growth plan, 25 seats, renewed 3 weeks ago. The ticket is SUP-2291. Two writes, so I’ll wait.

Waiting on a human

Raise Vasquez Ltd from 25 to 40 seats

Prorated now; next invoice moves from $2,375 to $3,800.

billing/stripePOST /v1/subscription_items/si_88…

Reads run. Writes wait.

03Hold

Reading is free. Changing something is not.

Every write through the proxy posts what it intends to do and waits — Confirm, Cancel, or hand the thread back and say what you actually wanted. Writes that are nobody's to self-approve leave the thread and go to an approver instead.

attest_tagdirect message

attest_tagApp11:04 AM

Access request · tier Approver

Priya asked in #eng-oncall for production access to be granted to a new on-call rotation.

POST/api/v2/teams/oncall-eu/members
PUT/api/v2/escalation_policies/EP-77

Both calls run in order under the tier’s own bundle — not yours, and not the channel’s. Stops at the first failure.

You cannot approve your own request. Enforced three times over, once in SQL.

Some writes are nobody's to self-approve. Those leave the thread entirely.

04Ship

And when the fix is obvious, it opens the pull request.

A separate container clones the branch, runs the tests, makes the change, runs them again, and opens a draft PR carrying the brief, the evidence, and the test results before and after. It may push one branch. It never merges.

eng-oncallthread

Priya9:14 AM

yes please — raise it as a draft against main

attest_tagApp9:14 AM

Fix job #f-4172 · acme/storefront

clone
tests baseline
fix
tests
pull request

It may push one branch and open one draft PR. It never merges, and never pushes to main.

A separate container, a single-use token, one new branch — and a draft PR at the end of it.

Connections

The model emits a URL. The proxy does the rest.

Every AI vendor says the model never sees your credentials. This is the path a request actually takes.

The model

emits http_request with a URL and no secret

In-process proxy

1ResolveWhat may this channel reach? The union of its scopes and bundles, cached for a minute.
2MatchHost, path prefix and method against the connection. Anything else is refused, with a reason the model can act on.
3InjectThe credential joins here, at the network edge. 30-second timeout, redirects not followed.sealed credential store
4HoldWrites wait for a Confirm in the thread. Reads are never held.
5ScrubCredential values and anything secret-shaped are stripped from the response, then audited.

Your service

GitHub · ClickUp · Sentry · Jira · an MCP server · your own API

The credential is AES-256-GCM sealed at rest and joins the request one hop before the service. It is never in a prompt, never in a tool result, and never in what comes back.

How connections work

Admin console

Everything it did, and everything it may do.

Served by the same binary, at /admin. Spend against budget, every turn and tool call, what each channel can reach, and who may approve what.

app.attesttag.com/admin

Overview

This month$6.41 / $20.00

1,284

turns

3,910

tool calls

216

documents

48

memories

ChannelToolCost

#eng-oncallsentry_issues$0.0021

#supportclickup_search_tasks$0.0014

#eng-oncallstart_fix_job$0.1840

DM · Meisearch_docs$0.0009

#people-opsread_channel_history$0.0011

The console, drawn from the same design tokens it ships with. Figures are illustrative.

Models & cost

Open weights by default. Your endpoint either way.

It speaks the OpenAI-compatible API, so it runs on OpenRouter, on a vendor endpoint, or on something you host yourself — and on z-ai/glm-5.3-flash out of the box. A cheap model answers most things; a heavy one is routed to automatically for code, for long threads, and for turns that have already made eight tool calls.

Every completion’s tokens and cost are recorded, so the number under a reply is measured, not estimated — and the monthly budget is a ceiling the bot stops at rather than a line it reports having crossed.

Model routing in detail

$0.002

a typical answered question

1

Go binary, console embedded

0

credentials the model can read

100%

of turns, tools and spend audited

Guardrails

Built for the day it gets something wrong.

A model that can reach your systems is only as safe as what happens when it misreads the room. Every one of these is enforced outside the model.

Tool output is data, never instructions

Results are wrapped and the prompt forbids following anything inside them. Fake tool-result tags in model output are stripped.

No credential ever enters the model

Sealed at rest, injected at the edge, scrubbed from every response before it reaches the model or the thread.

Nobody approves their own request

Enforced three times over, once in SQL. Requests route to the least powerful tier that covers every call in them.

Reads stay inside the asker's Slack

The bot is in channels you are not. It checks your membership before reading any conversation that isn't public.

Web fetches cannot reach your network

Non-HTTP schemes and private, loopback and link-local hosts are refused. The proxy reaches allow-listed hosts only.

Everything is on the record

Every turn, tool call, proxied request and completion, with tokens and cost, exportable as CSV.

Read the guardrails

Pricing

One workspace. Every channel.

Priced per workspace, not per seat — the whole point is that everybody in the channel can use it. Model spend is yours, metered at cost, capped by a budget you set.

See pricing

Questions

What teams ask first

Do we have to hand it our API keys?

You give a credential to the service, not to the model. Secrets are sealed with AES-256-GCM in the database and injected by an in-process proxy at the network edge, one hop before the request leaves. The model only ever emits a URL and a method. Responses are scrubbed of the credential values, and of anything else that looks like a secret, before they reach the model or Slack.

Which model does it run on?

Whichever you point it at. It speaks the OpenAI-compatible API, so any endpoint that does — OpenRouter, a vendor API, or something you host yourself — works. It ships on an open-weight default and lets you set a different model per workspace, per channel, or per thread. On OpenRouter it routes only to providers that do not train on prompts.

Can it change things without asking?

Not by default. Any method other than GET, HEAD or OPTIONS is held: the bot posts what it wants to do and waits for a Confirm in the thread. Admins can pre-approve expected writes by writing plain sentences as allow rules, and a strict model check has to agree the rule clearly covers that exact action. Anything unclear still waits for a human, and no allow rule can pre-approve a request that needs an approver.

Can it read channels we haven't invited it to?

No. It reads with its own token and is in channels the asker is not, so before touching any conversation that is not the current one and not a public channel, it checks the asking user's own membership. Privacy is read from the channel's own record rather than guessed from its id, because a public channel converted to private keeps the same prefix.

What does it actually cost to run?

A typical answered question on the default open-weight model costs a fraction of a cent, and every completion's tokens and cost are recorded, so the number in the console is measured rather than estimated. A monthly budget for the workspace and another per channel pause the bot when spend passes them, and a per-user hourly rate limit caps the rest.

Where does our data live?

In one database you control, replicated off-box if you want it to be. Threads are rebuilt from Slack on every turn rather than mirrored into a separate copy of your workspace. Documents are indexed from a folder or a bucket you point it at. What leaves the box is the model call itself, to the endpoint you chose.

What do we have to migrate?

Nothing. It joins channels you invite it to, indexes documents you point it at, and reaches services through credentials you connect. There is no import step, no separate place your team has to go, and turning it off leaves your Slack exactly as it was.

Put it in one channel and see what it does.

Half an hour, your workspace, one channel and one connected service. You will know by the end of it whether this belongs in your Slack.

Book a demo What setup involves