§01  /  Agents

Agents inside workflows.
Workflows inside agents.

Lyhnis speaks MCP on both sides. Expose the workflows you have authored to Claude, ChatGPT or any MCP client as typed tools. Equip your own agents with external tools from any MCP server. Four budgets the engine enforces, and human gates that pause across multi-day waits.

Read the agent docs →See the full trace
agent.run · claude-sonnetTurn 4 / 25
→ tool_call verify_identity(customer="c_8812")
← ok · sub-workflow · 1.2s · 0 tok
→ tool_call process_refund(amount=248.00)
← paused · human.approval · #finance
   …2d 04h later…
← ok · approved by ops@acme · slack
→ tool_call ledger_mcp.post(ref="rf_2291")
← ok · external MCP · 0.4s
✓ done · rollup $0.021 · 4 turns
author-defined vocabularyengine-enforced budgets
§02  /  The wedge

Sub-workflows as tools.

The agent never gets raw API access. It gets the workflows you authored - with validation, HITL gates and audit-by-construction already wired in before the agent ever sees them. The workflow is the safety primitive.

the boundaryauthor-explicit
parent_agentclaude-sonnet · 8 turnsinvokes as toolprocess_refundyour sub-workflow
process_refundvalidation · HITL · auditcallsstripe.refundnever agent-direct
author-defined vocabularyengine-enforced boundaries
What the agent cannot do
  • ×Reach a raw API key or credential
  • ×Skip a HITL gate inside a tool
  • ×Invent a tool you did not declare
  • ×Exceed a budget by reasoning about it
  • ×Write to the audit ledger, or around it
What the agent can do
  • ✓Call the workflows you listed in tools
  • ✓Chain them in an order you did not script
  • ✓Read the typed results and decide
  • ✓Call external MCP tools you credentialed
  • ✓Hand off to a human and wait
§03  /  MCP duality

Both directions of the bridge.

One protocol, two roles. Your tenant gets an MCP server so external agents can call in; your workflows carry MCP credentials so agents can call out. Same audit ledger for both directions.

Inbound · expose workflowsMCP server
# your per-tenant MCP endpoint
https://mcp.lyhnis.com/t/acme

# JWT-bridge auth, scoped per client
Authorization: Bearer eyJhbGciOi…

# tools the client sees
- process_refund      (workflow)
- verify_identity     (workflow)
- lookup_invoice      (workflow)
Per-tenant serverhard isolation
JWT-bridge authscoped tokens
Every call auditedactor=agent
Outbound · call external toolsMCP_OAUTH
credentials.create(
    name="linear_mcp",
    type="MCP_OAUTH",
    server_url="https://mcp.linear.app",
)

agent.run(
    model="claude-sonnet-4-7",
    tools=[process_refund, mcp("linear_mcp")],
    budget=budget(turns=10, tokens=50_000),
)
Fernet-encryptedper-tenant key
Step-up to rotatealways
mcp.call loggedserver + tool
§04  /  Engine-enforced budgets

Four limits the agent
cannot exceed.

Budgets live in the engine, not the prompt - the agent cannot talk its way past them. Set them on the outer agent.run and the parent covers every child it spawns.

Iterations17 / 25
025 · kill

Hard cap on tool-call turns. The agent cannot reason itself into a loop you did not authorize.

budget(turns=25)
Tokens31,420 / 50,000
050k · kill

Combined input and output across the whole run, counted recursively through nested agent calls.

budget(tokens=50_000)
Wall-clock02:14 / 05:00
05m · kill

HITL pauses do not count - only active reasoning time does. A 48-hour wait costs nothing.

budget(wall_clock="5m")
Cost (USD)$0.342 / $0.500
$0$0.50 · kill

Real dollars: nested agent spend, model fees and tool-side metered usage.

budget(cost_usd=0.50)
Recursive rollup

Parent budgets include every child agent's spend, every sub-workflow's tokens and every external tool call. Cap the whole tree from the top; auditors get one number per run.

See the v2.35 rollup →
§05  /  Flagship sequence

One workflow. Two actors.
One audit log.

An agent-triggered refund end to end - from MCP invocation through a two-day human pause to recursive cost rollup. Every actor and resolution source captured by construction.

TimeOperationActorResolutionCost / detailState
14:22:04.881mcp.invokeAgentclaude · client acme-csjwt-bridge · scopedaccepted
14:22:05.104verify_identityAgentsub-workflow · tool #11.2s · 0 toksuccess
14:22:41.552ocr.extract_invoiceSysteminvoice.v2 · 14 fields1 page · 1.9ssuccess
14:23:02.910human.approvalHuman#finance · 2 approversgate opened · 7d expirypaused
+2d 04:12human.approvalHumanops@acme · slackpaused 2d 04h 12mapproved
14:31:56.220saas.stripe_refundAgentsonnet · tool #3€248.00 · 0.6ssuccess
14:32:08.114mcp.call · linearAgentlinear_mcp · MCP_OAUTHexternal · 0.4ssuccess
14:32:09.006audit.commitSystemhmac-sha256 · per-tenantrollup $0.021 · 8.2k toksealed
2 actor types · 1 ledger · 0 instrumentationExport: CSV · JSONL · SIEMThe ledger →
Actor typing

Every entry is AGENT, HUMAN or SYSTEM - never an anonymous service account.

Resolution source

Which channel answered, which model decided, which credential was used.

Cost contribution

Per-span spend, rolled up to the run. No reconstruction from logs.

Signature

HMAC-SHA256 over a per-tenant key. Chain integrity verifiable on export.

§06  /  Begin

Build the next agent worth shipping.

For engineers

Install the SDK.

Declare your tool vocabulary in Python, set the four budgets, and let the engine hold the line.

$pip install lyhnis
Read the docs →
For operations

Open the canvas.

Drag activities, place your approval gates, hit run. No local setup, same execution layer.

Book a demo →Talk to engineering
See pricing →