onramp.sourcesModule 19Move an existing agent fleet into the plane from an export you already have, after you have read exactly what would land.
onramp.sources lists the exports the plane can read: LangGraph, CrewAI, AutoGen, Okta, Entra, Terraform and Kubernetes. plan turns one into agents, grants, resources and edges without writing anything. apply then enrolls, grants and maps them through the live engines.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseEvery source is read from an export you post. Nothing connects to Okta, Entra, a cloud account or a cluster, and no provider or operator runs. Export the estate first, then plan and apply it here.
Plane module
vonramp/0.sourceslanggraph, crewai, autogen, okta, entra, and ./docs/onramp-sourcesAPI referenceRoutes, bodies and status codes./docs/onramp-sourcesOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./app/onrampStart freeCreate a workspace and admit your first intent./auth/signup
terraformkubernetesplan.agentsdid, displayName, source and origin, the place in the export it came from.plan.grantsprincipal, a resource and an action.plan.edgesfrom, to and rel, such as calls or may_call.plan.warningsat and reason. An agent is never enrolled under a made-up identifier.countsappliedapply, with each failure listed beside its reason.GET /api/v1/acp/onramp/sources returns the format version and the seven source names. Post the matching export with a source and your own namespace.
plan returns the agents, grants, resources and edges it would create, counts of each, and a warning for every row it skipped, with where it sat in the export.
apply enrolls each agent as a customer agent, writes each grant and records each edge through the operator path of cartographer.map. A row that fails is reported, and the others still land.
The answer carries applied: enrolled and failed agents, granted and failed grants, mapped and failed edges, and the count of resources named.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. onramp.sources docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
GET /api/v1/acp/onramp/sources Authorization: Bearer av_workspace_•••• → 200 { v, sources }
{
"v": "onramp/0",
"sources": [
"langgraph",
"crewai",
"autogen",
"okta",
"entra",
"terraform",
"kubernetes"
]
}A team posts its compiled graph. Each node becomes an agent and each edge a calls relation, so the fleet arrives with its shape intact.
A security lead exports service principals. Disabled ones are enrolled anyway and flagged in the warnings as not live at the source.
Migration moves grants as well as names. plan shows the whole change first, so a reviewer signs off on rows rather than a summary.
Service accounts become agents. A workload that runs as an account missing from the export is warned about, and no principal is invented for it.
identity.enroll, which apply itself calls for each agent.mandates.compile; this module only carries over what the export states.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
plan writes nothing: it reads the export you post and returns what would change.did:web:<namespace>:<source>:<id>; there is no default namespace.apply is re-checked against its own source and namespace, so apply cannot be used to write arbitrary rows.apply appends no ledger event.apply needs both policies.approve and agents.create, since it writes grants and enrolls agents. plan and sources need neither.
Post it under export, inventory, state, graph, crew, payload or data. If none of those is present, the body itself is read as the export.
A resource exists because a substrate has it. The plan lists the URNs the plane will use, and applied.resources.named counts them without writing anything.
source and namespace are both required; an unknown source or an empty namespace is refused with 400.., _ and -, and cut at 64 characters.plan and sources are not metered; enrolling through apply is metered like any other enrollment.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/onramp/sourcesList the export formats the on-ramp can read./api/v1/acp/onramp/planRead an export and return what would be created./api/v1/acp/onramp/applyEnroll, grant and map the plan, reporting each failure.This module has no MCP action. Call it over REST from any agent or program.
identity.enroll12Agent identity registryGive each agent its own identity before it acts, so every admitted action traces back to one agent and never to a shared account.cartographer.map17Cartographer edge reviewKeep connections between resources on a map you control: the cartographer proposes, and a person or a bound you wrote approves.mandates.compile03Mandate studio and replayWrite an agent's charter as code, see what it would change about who may do what, and apply it as the mandate's next version.coordination.fleetmap11Fleet MapRead every agent grant, lease, waiter and quarantine in the workspace in one call, drawn from what the plane has admitted.mcp.shadow13Shadow agent discoveryList the tool calls the MCP gateway has seen, with the agent behind each, so callers nobody enrolled show up beside the ones that are.civics.presence14Agent presenceLet agents see which peers are online and what each holds, so a quiet agent is not mistaken for a hostile one.trust.get15