Farpals: Extensible Sovereign Actions for Any AI

The description states that Farpals is an extensible, model-agnostic MCP gateway. It is built around the concept of application sovereignty — where AI agents propose actions but are constrained by the native permissions of the user within the application.

It separates a Node.js Core from a WordPress-specific PHP Adapter, with the Core handling transport, OAuth discovery, dynamic tool translation, and confirmation orchestration, while the Adapter keeps authority inside WordPress, managing identity, OAuth with PKCE, revocable agent keys, and execution enforcement.

Farpals is described as a reference implementation (v0.4) built for a hackathon, not yet a public SaaS offering. It uses technologies like Docker, WordPress, PHP, Node.js, OAuth2, MCP, and Google Cloud.

The author claims that Farpals is a solution to the growing problem of AI agents acting across software without respecting native permissions or user identities. The core idea is:

“The model proposes. Farpals constrains. The application decides.”

This positioning suggests a shift from AI tools that act independently or with broad permissions, toward ones that respect and enforce application-level access control.

The project positions itself as a gateway for AI agents to interact securely within applications, particularly focusing on WordPress as the first adapter. It is not positioned as a general-purpose AI tool but rather as an infrastructure layer for secure AI integration.

It also claims to be model-agnostic, meaning it works with any AI model that supports MCP (Model Control Protocol), and that it does not create parallel roles or permissions, instead relying on native application capabilities.

The description states that Farpals is built for AI agents that need to act within applications while respecting user permissions. It targets developers or organizations who want to integrate AI into existing software (like WordPress) and maintain control over what those AI agents can do.

The first adapter is WordPress, which implies a target audience of WordPress users, developers, or administrators who are concerned with security and access control in AI integrations.

It also mentions that the project aims to extend beyond WordPress to other domains like commerce, scientific data, productivity, and creative tools. However, no specific customer segments or personas are defined beyond this general idea.

Not evidenced.

The description does not include any information about pricing, monetization strategies, or business model assumptions. It only describes a reference implementation and future plans for managed hosting and plugin-first onboarding.

• Farpals is built using Node.js (Core) and PHP (Adapter).
• It uses OAuth2 with PKCE, MCP, Docker, WordPress REST API, and MariaDB.
• The architecture separates the Core from the Adapter, allowing for modular deployment.
• It supports dynamic tool translation, confirmation orchestration, and bounded audit records.
• The system is described as a reference implementation (v0.4) with automated tests, including 18 of 18 Node.js tests passing.
• It includes support for OAuth discovery, refresh token rotation, Agent Key revocation, and object-level authorization.
• The project uses GitHub Actions and Docker workflows for CI/CD.

Not evidenced.

The description states that Farpals is a reference implementation (v0.4) built during a hackathon, not yet a public SaaS offering. It includes a hosted evaluation prototype but does not mention any real-world deployments or customer usage beyond the development team and judges in a lab environment.

There is no evidence of revenue, ARR, headcount, or adoption metrics.

Not evidenced.

The description does not provide information about competitors or how Farpals compares to existing solutions for AI agent integration or access control within applications. It does not mention any direct or indirect competitors.

• No production-grade features: The system is described as a hackathon prototype, not yet a public product.
• Limited scope: Only WordPress is mentioned as an adapter; no evidence of broader adoption or roadmap for other platforms.
• No customer data or traction: No evidence of real users, customers, or revenue.
• Unproven scalability: The architecture is modular but has not been tested at scale or in production environments.
• Unclear monetization path: No indication of how Farpals will generate revenue or be commercialized.

1. What are the next steps to move from a hackathon prototype to a public SaaS offering?
2. Are there any early adopters or pilot users beyond the development team?
3. How does Farpals plan to scale beyond WordPress and support other platforms?
4. Is there a roadmap for monetization, and how will it be priced?
5. What are the technical challenges in moving from a reference implementation to a managed service?
6. Are there any partnerships or integrations planned with AI vendors or platform providers?