Overview

We believe employees will increasingly control tasks in natural language. Agents will not only answer questions, they will execute tasks. To do so they need access to protected corporate systems without credentials being stored in agents and configurations.

The Weldall Ecosystem connects three building blocks. Together they solve how employees can securely use corporate functions via agents, how these functions can be made available as services, and how connections to existing systems are protected.

Weldall CLI

Weldall CLI is the tool for access via agents. The CLI runs on the employee’s device and becomes the company’s central skill library. Each employee sees only the skills they are authorized to use. Administrators centrally control who may use which scopes. Skills describe in natural language how the agent should perform specific tasks within the respective company. The CLI is generally not used by employees, but by an agent such as Copilot, Claude Code, Pi or OpenCode. A skill serves as a manual explaining how the agent invokes commands such as weldall scopes list or weldall request.

Weldall CLI is open source, self-hostable and one of the first repositories on GitHub to implement the Identity Assertion JWT Authorization Grant. It follows current OAuth standards: ID-JAG, JWT Authorization Grant with DPoP, RFC 8252, RFC 7636, RFC 9700 and RFC 9449.

This prevents secrets or passwords from being lost. The agent never receives an access token. Short-lived, DPoP-bound tokens cannot be reused on another system. Administrators retain control over tokens, keys and audit logs.

Details:

• Why Weldall CLI?
• A complete agent run
• SDKs
• Integrate a service
• Security

Weldall Stack

Weldall Stack is the bundle that allows companies to provide services for agents. It is based on a combination of open source projects and operations by Seibert Group. The stack is deployed for customers at Seibert or on customer premises.

With it, internal applications such as contract management can be made available as a web service without employees needing to know API details. We believe the circle of people who can develop software has widened significantly. With Vibe Coding, teams can set up services faster. Weldall Stack helps make this happen securely.

More on the Seibert Group overview: weldall.seibert.group.

Weldall Gateway

Weldall Gateway sits between Weldall and proprietary external services such as HubSpot or Personio. It tunnels requests when only one API token per company exists or the granularity of rights in the external system is insufficient.

The gateway filters by REST endpoints, applies additional policies and monitors usage.

Example: New employee

A new employee joins the company. The agent has to work with several systems:

• Store the employment contract in the contract management system.
• Create an entry in the HR tool (e.g. Personio).
• Send a welcome message in MS Teams.

The exact procedure is described in a skill. Access to the different systems is protected by scopes. Administrators centrally define which scopes the employee has. The agent sees no credentials. Weldall logs granted and denied access.

Similar workflows apply to tasks such as recording travel expenses or reviewing contracts. The specific steps vary by industry and organization. In all cases, the agent finds the appropriate skill, checks permissions through the CLI and calls the service without managing tokens.

Consultancy

At Seibert Group, experts in web security, software development and corporate consulting work together to help you introduce Weldall successfully. We enable business domain experts to become citizen developers who can turn their knowledge into secure, reusable resources for the entire company. With Weldall, teams can build and share agent-compatible workflows independently—while maintaining security, governance and freedom from vendor lock-in.