Scripting Scellis: the API and the Copilot

Everything the Studio does, it does by calling an API — the same API you can call. The interface is a client of the API, not the other way around: every action you take in Scellis is a typed verb on one API service, and the interface itself speaks those verbs. The rule that follows is symmetrical and complete: anything you can click, you can script; anything you can script, the Copilot can do on request; and the same surface is what an external agent reaches over MCP. This page walks that programmatic surface — the verbs, the callers, the consent model, and the lines no machine may cross.

The interface is just another client#

Most applications grow a private API for their own interface and a second, smaller one for everyone else. Scellis has one. When you fork a block in the catalog, the Studio calls the same catalog.fork your script would; when you pause a run, the same run.pause. And parity is not a policy statement — it is verified automatically: the same operation performed through the interface, through the raw verb, and through the Copilot must produce identical state. If the three ever disagree, that is a defect caught before release, not a support ticket.

Verbs that read like the product#

The surface is organized as roughly thirty verb families, and the list reads like a tour of the platform. Reading, building, running, and tracing are all just verbs:

// The verbs the interface calls are the verbs you call.
const hits = await scellis.catalog.search({ q: "robust scaler", kind: "block" });
const prog = await scellis.program.create({ from: hits[0].id });
await scellis.program.compile(prog.id);           // Green / Yellow / Red — with diagnostics
const run = await scellis.run.start(prog.id, { tier: "prod" });
for await (const m of scellis.run.observe(run.id)) {
  console.log(m.epoch, m.loss);                    // 12  0.31  — live, downsampled
}
const lineage = await scellis.provenance.trace(run.id);   // both directions

Family	What it covers
catalog	search, create, update, fork — everything you have, one namespace
program · model	create, patch, diff, compile, inspect the lowered IR, 3-way merge; the full Model View surface
run	start, pause, cancel, observe — live status and downsampled metrics
publish · provenance	ship your work; trace forward and back, mint reproduce links
workspaces · audit · sharing · invitations · notes · notifications	govern, log, invite, annotate, catch up
pools · jobs · federation · marketplace · billing · connectors · credentials · datasets	distributed compute; commerce; data sources and their credentials; datasets — split, label, profile

Two families reward a closer look. program treats a workflow the way version control treats source — create, patch, diff, compile, inspect the lowered IR, reconcile with a 3-way merge — and it drives the full Model View surface. And run is built for observation as much as control: a running job reports live status and downsampled metrics — enough for an agent watching your training to narrate it honestly, “epoch 12, loss 0.3”, without pulling raw data — while provenance makes every result traceable in both directions, and pools and jobs open the same distributed compute the interface uses.

Who is calling — the server decides#

Identity is deliberately plain. Scripts authenticate with scoped API keys; the interface runs on sessions; external agents pair over MCP. From how a call arrives, the server works out who is calling — you in the app, the Copilot, a headless script, an API key, an outside agent. That answer is derived on the server, not supplied by the caller, so a client cannot forge it. The distinction carries weight, because the platform's hardest guarantees key on it: the money rules below hold precisely because “a real click by you, in the app” is something the server can verify and nothing else can imitate. How that one surface is generated for outside agents — and what an agent may and may not touch — is the agent surface.

Fig. 1 — The assistant never acts behind your back. It drafts the change as ordinary edits and shows you the exact difference before anything happens; only your confirmation applies it. What it did stays attributed to it — and one undo takes it back.

Every verb, every caller, the same three tiers. The tiers do not vary by caller, so a script cannot slip past a dialog the interface would have shown, and a write consent shows the concrete diff about to happen — never a bare “allow?”:

Tier	What it takes
read	free — searching, inspecting, and tracing cost no dialogs
write	an explicit consent showing the concrete proposed change
destructive	confirmation, and rate-limited on top

And when the caller is the Copilot, nothing happens invisibly: every Copilot action renders as an explicit tool call — an inspectable program operation, visible where you work, attributed to the assistant rather than blended into your own history. It can even program.undo its own change.

The Copilot: out of the box, then your own key#

The Copilot works the moment you arrive: a starter quota is included, brokered through the server, so driving Scellis in natural language works in your first minutes. The steady state is bring-your-own-key.

Note

Your provider key lives encrypted on your device and never lands on Scellis servers. Every call to the provider is an explicit, consent-visible network effect — and a workspace policy can block it entirely. The full trust model is on the security page.

With that in place, the Copilot's range is the API's range:

Understand: search and explain anything.
Build: compose and edit workflows and models.
Operate: launch runs and observe them as they progress.
Collaborate: author and resolve notes; read and summarize notifications — “what happened while you were away”.
Extend: install free packs and join altruistic compute pools — each with your consent.
Draft: merges and share proposals, prepared for a human to accept.

External agents, over the same surface#

The Copilot is not the only agent that surface can serve. External-agent access over MCP — Claude and any MCP-compliant client as a third consumer — is on the early-access track, and its whole tool surface is generated from the live verb registry rather than hand-built: a new capability appears at the next regeneration, with no bespoke tool to write. Pairing is an explicit in-tab gesture; while paired the tab shows a persistent “agent connected” indicator, a live per-call activity feed, and one-click revoke. Read calls the server can answer work with no tab open; anything that touches the engine or writes state is relayed to your one paired live tab — no tab means nothing above read.

The security model, layered#

The security model is layered by design. Tokens are short-TTL and audience-bound to a durable, revocable Agent Grant (you × client × scope set × expiry); scopes are a namespace × consent-tier grammar that cannot even construct a commerce scope; grant approval is human-UI-only, never a self-escalation. The same money bar the Copilot meets is enforced twice over for MCP — money verbs are excluded from the projection at generation time and refused again at dispatch. The mechanism is the subject of the agent surface.

What no prompt can unlock#

The denials are structural, not settings. No agent — the Copilot, a leaked API key, a headless session, or an external MCP client — can ever purchase, pay, tip, refund, or trigger a payout; raise budgets or enter priced compute arrangements; touch your credentials; accept an ownership transfer or a share proposal (it drafts, a human accepts); or perform account deletion or data rectification (it surfaces the right, you exercise it). Enforcement is server-side: money-moving verbs are admitted only from a human gesture in the interface, carrying a fresh single-use nonce.

await scellis.purchase.checkout(listingId);
// ✗ refused — this call did not come from you, in the app.
//   A payment clears only from a real click, carrying a one-time
//   token. No API key, no script, and no agent can mint one.

Fig. 2 — The one line no machine crosses. A payment clears only from a real click by you, in the app, carrying a one-time token it cannot reuse — so the Copilot, a script, and an outside agent are all refused at the same bar. Not because we told them not to: because there is no path.

That is why a prompt-injected Copilot, a leaked API key, a headless session, and a paired MCP agent all still cannot buy — none of them can be a human in the interface. A few other moments are gesture-bound by the browser's own security model — picking a local file, completing an OAuth popup — and there the Copilot prepares everything and hands you one clear step to finish. Your rights over your own data are verbs too: access, export, rectification, restriction, erasure — first-class operations, answered within a month. The Copilot will point you to them; exercising them stays in your hands.