The AI workspace your agent can actually operate.
Notebooks, datasets, models and agents on your own machine. Every capability is a typed tool that runs headless, so an agent drives the workspace instead of sitting in a chat panel beside it. Policy decides what it may do, and every run ends in a signed evidence package.
Runs on your machine. macOS and Linux, with a 7-day trial.
What makes it different
Built for a person, or built for an agent.
A VS Code extension contributes commands, views and menus, and it waits for someone to choose one. Since 2024 it can also register a tool a model calls, and VS Code now documents how an extension can ship an MCP server as well. What neither carries is a rule evaluated on the call itself. An IVYX capability declares its inputs and outputs as JSON Schema, carries a risk level and an approval requirement in the same manifest, and every call it makes is checked against a policy rule and written into the run record.
| Criterion | VS Code extensions | IVYX capabilities |
|---|---|---|
| Built for | A person clicking | A person or an agent |
| Callable by a model | Yes, inside a running editor session | Yes, every capability in the workspace |
| What says no | A confirmation dialog, if you are there to see it | A policy rule, whether you are there or not |
| Aware of the arguments | No. The dialog authorises the tool | Yes. A rule matches an argument tuple |
| Kept as a record | No | Yes, one signed evidence package per run |
This is also why the gate exists. When an agent can reach every capability with nobody watching, a confirmation dialog is not a control: there is nobody to click it. Policy has to be the thing that says no.
Three words used on this site: an extension is what you install; it exposes one or more capabilities an agent can call; an ivy-node is a capability IVYX generated for you, with a manifest.
Against your stack today
Your notebook does not remember what it did.
Today the record lives in two places: the notebook that ran, and the tool you bolted on to track it. IVYX keeps one.
| Criterion | Notebook and a tracking tool | IVYX Studio |
|---|---|---|
| Where the record lives | Two systems, joined by hand | One record per run |
| Dataset identity | A file path | A path, with the pipeline engine content hash where it supplies one |
| What the agent did | In a separate trace, unlinked to the run | A call tree, refusals included |
| Stopping an action | Not possible | At the gate, before it executes |
| Extensions | Somebody else's plugin | A typed capability you own and version |
Nothing runs until policy says yes. Nothing risky runs until you do.
Every model call, tool call and agent step passes the same gate.
The decision is made before the action happens, not logged after it. A deny is terminal: no prompt and no standing grant satisfies it. An action whose manifest declares it high-risk stops and waits for you, and the grant is bound to the arguments you saw.
run train-churn-classifier├─ capability.audited datasets.download allowed: true├─ capability.audited mlops.pipeline.run allowed: true├─ capability.audited mlops.model.promote → production allowed: false│ reason: Denied by policy rule churn-project#0.└─ capability.audited mlops.model.promote → staging allowed: true reason: Approval required (step). → granted, scope: once
Example run. Every line is a gate decision, kept with the run.
Policy, next to the work
Rules live with the workspace in a policy file, with conditions on the arguments of a call. Export them to the files your gateway needs, and the export names every rule that could not cross.
Your go-ahead on risk
A capability whose manifest declares it high-risk stops and waits. You see the call, its arguments and the numbers it is claiming before you approve, and the grant covers those arguments only.
An audit chain, not a log
The datasets and files a run touched, with the engine content hash where there is one; every gate decision with the rule that produced it; evaluation figures with the bounds they were measured against. One signed evidence package per run.
Typed, not trusted
An AI-built component declares its inputs, outputs and risk in a manifest, and every call it makes is schema-validated, policy-checked and audited before it executes.
A node is a contract, not a snippet.
Describe what your workspace is missing and IVYX writes it as an ivy-node. The manifest declares what the node may do: which actions it uses from a closed vocabulary of fourteen, what risk it carries, whether it needs a person. Policy binds to that declaration, which is what makes a generated component something you can govern instead of something you have to trust.
Nothing is hidden. The source of every generated node sits in your workspace and in Git, open in the editor. The manifest is what policy reads, not a substitute for reading the code.
ivy-node
The manifest is the component.
Describe a capability your workspace is missing and IVYX writes it as an ivy-node: typed inputs and outputs, a declared risk level, and a validated manifest. The code is one implementation of that contract, and it stays open in your workspace.
- Generate a node with a validated manifest and typed inputs
- Discover, search and register nodes in a central registry
- Test and validate a node before it runs anywhere
- Version, reuse and install components from the marketplace
ivy-agent
Bring workflows to life.
Turn code components into intelligent workflows. Design, test and run them, with governance built in. From simple background tasks to complex operations, full control is in your hands.
- Transform ivy-nodes into runnable workflows
- Approval workflow and policy-based risk assessment
- Artifact store, observability and audit trails
ivy-mcp
Add MCP power to your project.
ivy-mcp simplifies how your projects connect with other systems. Write your own MCP methods, publish your MCP server, and manage the tools it exposes.
- Develop custom MCP methods
- Publish and serve your MCP server
- Connect with external systems like Claude Desktop and Claude Code
Included in the workspace.
Not add-ons. Every published extension is bundled and enabled the first time you launch it.
Work
- Notebooks and local kernels
- Code editor
- Native terminal and Git
- Command palette
- AI assistant
Data
- Dataset manager for Kaggle and Hugging Face
- CSV and Parquet profiler
- PostgreSQL and MySQL browser
- Object storage: S3, GCS, Azure Blob, MinIO
Models
- Local and remote LLMs
- Training runs, tracked and compared
- Model registry and promotion
- Signed evidence packages
Ops
- Run history and comparison
- Offline scoring on your golden sets
- Policy gates and approvals
- Policy export for your gateway
- Audit export
Every item above is also a callable capability. This is not only what you get; it is the action space your agents work in. The marketplace adds more.
MLOps and LLMOps
Pass the audit without changing platforms.
Models, under policy
Do the work on your own machine, and still be able to show what happened.
Every run records the datasets and files its calls touched. Promote a model and you can build a signed evidence package from it: the training run it resolves to, every gate decision, and the bounds each figure was measured against. Keep MLflow if you have it. IVYX writes to it, and adds the record MLflow cannot produce on its own.
Datasets by name
A run names the datasets and files its calls touched, with the pipeline engine content hash beside them where it supplies one.
Figures with their bounds
A number is recorded with the bound it was compared against and which side of it passes, because a bound without its direction can be read backwards.
Promotion, approved
Promotion is declared high-risk in its manifest, so it stops for a person, and the approval is recorded with the call it authorised.
Keep your registry
MLflow stays your registry, DVC stays your data versioning, and IVYX reads and writes both rather than replacing them.
Agents, under policy
The policy is written with the agent and exported to production with it.
Score prompts against your own golden sets locally. A network proxy cannot see an agent that has not left the developer's machine yet; the gate can. The rules you write here export to the files your gateway needs, and the export names every rule that could not cross rather than quietly dropping it.
One gate
Every model call, tool call and agent step is evaluated against the same rules, before it runs.
Export to production
The rules that governed the run export to Obot or Arcade, checked against a running engine so the same rules give the same verdicts.
Traces where you keep them
IVYX exports over OTLP, so Langfuse, Phoenix, Tempo, Jaeger and Datadog all work without a vendor-specific integration.
Local models
Ollama and GGUF runtimes, managed from the workspace, with nothing leaving the machine once the weights are on disk.
Use it, or build on it.
The same governed core, from two directions.
Use IVYX Studio
The desktop workspace for data, models, notebooks and agents. macOS and Linux, with a 7-day trial and then a licence key.
Download IVYX StudioBrowsing the marketplace stays open to everyone, with no account.
Build on the governed core
Ship your own product with customer-safe AI extensibility: private registry, self-hosted or air-gapped, audit export included.
Talk to usBuilt for the people who have to answer for it.
Three roles, one question: what ran, on what data, and who allowed it.
ML engineers
Ship a model with its provenance attached, instead of reconstructing it a quarter later.
Data scientists
Notebook to run to artifact, without bolting on a second tool just to track what happened.
Platform and compliance
One policy language for laptops and production, and an audit chain you can hand to a reviewer.
Learning instead? The Education marketplace has guided, notebook-based courses that run inside the app. Education
Extensions, ivy-nodes and courses, installed from inside the workspace.
An IVYX extension is not a UI plugin. It declares typed inputs, runs headless, and is callable by an agent the moment it is installed, so installing one widens what your agents can do, not just what your menus show. Everything published today is built by the IVYX team; third-party publishing opens with the registry, and the publishing guide is open now if you want to be among the first.
What is free, and what is not.
Stated plainly, because this is the first thing a technical buyer checks.
Studio
The desktop app and marketplace installs. Browsing the marketplace and reading every listing stays open to everyone, with no account.
Team
Hosted assistant, shared workspaces and secrets, private registry, SSO and roles.
Enterprise
Self-hosted registry, air-gapped installs, audit export, compliance controls, SLA.
Frequently asked
How is this different from Jupyter or a normal IDE?
Jupyter and IDEs know files; IVYX knows runs, capability calls and gate decisions. Think of what VS Code did for code editing, a small core extended by components, and apply it to AI work with a core that also understands what a run, a dataset and a gate decision are. When something is missing, you describe it and keep the component instead of waiting for a plugin.
How is an AI-built feature kept safe?
An AI-built feature declares its inputs, outputs and risk in a manifest. Every call it makes is schema-validated, checked against policy and written to the run record before it executes, and anything its manifest declares high-risk stops and waits for you.
Do I have to approve every action an agent takes?
You do not approve every action an agent takes. A policy rule decides each capability call in advance, and only the actions whose manifest declares them high-risk stop and wait for you, which is what keeps the interruption meaningful when it comes. The how-it-works page follows one such run from the first call to the signed evidence package.
How is an IVYX capability different from an MCP server?
An IVYX capability and an MCP server both expose typed, callable capabilities, and IVYX speaks MCP through ivy-mcp in both directions. The difference is what travels with the declaration. A capability manifest is what policy is evaluated against, the decision is bound to the arguments of that call, and every call joins the same signed evidence package as the datasets and files around it. An MCP server declares what it can do; a capability also declares what it may do.
Can I read the code IVYX generates?
You can read all of the code IVYX generates. The source of a generated node sits in your workspace and in Git like any other file. What policy checks is the manifest, its declaration of what the node may do, so the code stays fully open to you while the boundary stays enforceable.
Do I have to leave MLflow, DVC or Ollama?
You keep them. MLflow, DVC, Ollama, promptfoo and Evidently are integrated directly, and traces are exported over OTLP, so Langfuse, Phoenix, Tempo and Datadog keep working too. What IVYX adds is the gate and one run identity across all of them, which they do not share with each other.
Where does my data live?
Your data lives on your machine. Files, datasets and local models stay local unless you deliberately connect a hosted service.
Is it really free?
IVYX Studio is free to try for 7 days. After that a licence key unlocks the desktop app and marketplace installs, while browsing the marketplace and reading every listing stays open to everyone. Hosted services, shared workspaces, a private registry and support are priced separately.
Can I use it without installing?
IVYX Studio is a desktop application today, and a browser version is planned. The desktop app is the full experience: native terminal, local files, Git and offline work.