How do you make a product AI agents can use?

1. Can an agent do everything a person can, without the website?

Every action in the dashboard should also exist in an API. If even one step only works by clicking, an agent gets stuck there and hands the job back to a person.

All three North Bay Ventures products follow this rule. Sandboxer has a REST API described by an OpenAPI file, plus TypeScript and Python SDKs. Transformer has a REST API, and nothing in it is dashboard-only. Flagger.gg has an API alongside its console. Read what makes a company AI-native for why this matters.

2. Does the CLI print JSON?

Coding agents live in a terminal, so a CLI is often the easiest way in. Make its output machine-readable: JSON, with errors that say what went wrong.

• Sandboxer's sbx CLI prints JSON when it's piped, so tools like jq can read every result. Sandboxer has a guide on scripting sbx with JSON output.
• Flagger.gg's flagger CLI supports --json on every command.
• Transformer has a CLI for brands and creators, installed with one command.

3. Is there an MCP server?

An MCP server lets AI apps such as Claude, ChatGPT, Claude Code, Codex and Cursor find and call your product's actions as tools. A hosted server is a URL with nothing to install; a local one runs on the user's machine.

Sandboxer, Transformer and Flagger.gg each run a hosted MCP server, and Sandboxer and Flagger.gg also offer a local one. Read what MCP is for how it works.

4. Are agent credentials narrow and revocable?

An agent should get only the access its job needs, and a person should be able to cut it off at once.

• Sandboxer: scoped API keys limit which tools work, and each connected MCP app is listed so you can disconnect it.
• Transformer: one key or connection acts for exactly one brand or creator workspace, and sign-in access can be revoked in settings.
• Flagger.gg: agent tokens cover one project, a list of environments and specific actions. They last 90 days at most, are stored as hashes and can be revoked.

5. Can an agent retry safely?

Agents retry when a network call times out, so a retry must never do the work twice. The usual answer is an idempotency key: the agent sends the same key with each retry, and the service returns the original result instead of repeating the action.

Sandboxer does this when creating and forking sandboxes: for 24 hours, the same key and request return the same sandbox instead of a second one you'd pay for. See its guide on retrying API calls with idempotency keys.

6. Does every change leave a trail?

When agents change things, people need to see who did what and why. Record every change with who made it, when, the before and after, and a note.

Flagger.gg requires agents to give a note on every write and keeps an audit log of every change, whether a person, an agent token or an import made it. Agents there have no approve tool, so the decisions a team reserves for people stay with people. See how the studio uses agents for the same idea applied to running a company.

7. Can an AI read what your product does?

Publish an llms.txt file: a short, plain-text description of the product with links to the details, written for AI assistants and agents. Sandboxer, Transformer, Flagger.gg and northbayventures.com all publish one. Read what llms.txt is.