Live now · Get your API key

Curated defaults

Ambient Desktop ships a small set of reputable, reviewed, pinned, and sandboxed capabilities as its default catalog, so the common tasks work without an agent installing unvetted packages.

The fastest way to compromise an agent is to let it install anything. Ambient Desktop ships a small set of reputable, reviewed, sandboxed capabilities as defaults, so common tasks work out of the box without gambling on unknown packages. A default capability is selected, described, pinned, sandboxed, and validated before it becomes an easy install path.

Ambient Desktop Plugin Manager.
Default capabilities are selected, described, pinned, sandboxed, and validated before they become easy install paths.
TRUSTED CAPABILITY PATHcurate · sandbox · diagnose1SelectselectsReputable upstreamsOfficial CLIsNarrow use cases2WrapwrapsDescriptorPinned runtimeToolHive policy3ValidatetestsInstall smokeSchema checksPermission tests4ExposeexposesDefault catalogUser approvalDiagnostics

Curated Default Capability Chain, the trusted capability path: curate, sandbox, diagnose. Stage 1, Select, selects: reputable upstreams, official CLIs, narrow use cases. Stage 2, Wrap, wraps: descriptor, pinned runtime, ToolHive policy. Stage 3, Validate, tests: install smoke, schema checks, permission tests. Stage 4, Expose, exposes: default catalog, user approval, diagnostics.

Curated Default Capability Chain: a capability is selected, wrapped, validated, and only then exposed as a default.

Curation is a security decision#

An open plugin market is a supply-chain attack surface. Any package an agent can install on its own is a package that could read your files, steal credentials, or drive a browser with your privileges. Asking a user to vet each one defeats the point of automation.

So Ambient curates the defaults. The capabilities that show up ready to install are chosen from reputable upstreams, wrapped in reviewed descriptors, pinned to specific runtimes, and isolated with ToolHive. You can still add your own, but the common path does not require you to trust a stranger's code.

The curated default catalog#

These are the kinds of capabilities Ambient surfaces as reviewed defaults. Each is a known, reputable upstream wrapped behind a pinned descriptor and permission policy. The Plugin Manager is where they appear: curated defaults, install state, and each capability's trust boundary.

Scrapling#

Public web extraction that adapts between fetch-based and browser-based scraping. Runs inside ToolHive because any page can be hostile.

Context7#

Up-to-date library and framework documentation lookup, so the agent grounds answers in current docs.

A reviewed web-search provider returns candidate sources and snippets, which the agent can then read with a fetch or browser capability.

Browser surfaces#

First-party, policy-bounded browser capabilities for rendering, login state, and screenshot evidence where extraction is not enough.

How a default earns its place#

A capability does not become a one-click default until it has passed a deliberate pipeline. The same pipeline is what makes the defaults safe to trust.

  1. Select#

    Start from a reputable upstream or official CLI with a narrow, well-understood use case, not an arbitrary community package.

  2. Wrap#

    Express it as a descriptor with a pinned runtime version and a ToolHive permission profile, so what it can do is explicit.

  3. Validate#

    Run install smoke tests, schema checks, and permission tests in release gates before it ships as a default.

  4. Expose#

    Only then does it appear in the default catalog, still behind user approval and with diagnostics and an uninstall path.

Scrapling, end to end#

Scrapling is a good example of the whole philosophy. Agents genuinely need web extraction, and Scrapling is good at it, which is exactly why it is risky, because extraction means loading pages an agent chose, not a human. Ambient ships it as a reviewed default, installs it through a pinned descriptor, runs it as a ToolHive-managed workload, and still keeps individual tool calls permissioned. You get the capability without handing arbitrary pages a foothold on your machine.

FAQ#

Can I still install things that are not curated? Yes. Custom MCP servers, Pi packages, and capabilities you build yourself are all supported. Curation governs the defaults, not your ceiling. Riskier additions just go through privileged review.

How is this validated? The curated catalog is covered by validation commands like validate:curated-marketplace and test:mcp-default-catalog, which check descriptors, schemas, and permission behavior.

Keep going#