From deployment and authentication to calling legacy portals via MCP — everything in one place.
Tixl turns legacy portals, proprietary ERPs, and government systems into stable APIs your AI agents and automation workflows can call. We reverse-engineer the underlying request chain — auth sequences, CSRF tokens, multi-step flows — and maintain that integration on our side. Your team calls the integration with business parameters; execution runs entirely inside your own network.
This covers systems that have never had APIs: claims portals built in 2004, state government filing systems, VMS platforms that only expose access to the enterprise buyer, hospital EHR operational workflows that FHIR doesn't reach. If a human can log in and navigate it in a browser, it can be automated.
Credentials never leave your network. Integration logic runs on our servers. The HTTP requests — with your session tokens and auth — execute from your machine, on your network, from your IP address. The portal sees a legitimate authenticated user.
We map the system
You run the workflow once in your browser. We capture every underlying request — auth, tokens, cookies, CSRF, the full chain — and build a stable integration definition. We maintain it as the portal changes.
Deploy your agent
One command connects a machine inside your network as an execution node. Requests execute from your IP, inside your firewall. Credentials and session data never touch our infrastructure.
Authenticate once
Log into the portal normally in your browser. Our extension captures the session — including HttpOnly cookies that DevTools can't reach. Import it once. The integration handles everything underneath from that point.
Call from anywhere
MCP, REST, CLI, or scheduled workflows. Your agent or AI calls the integration by name with business parameters. Auth injection, request chaining, retries, and self-healing all happen server-side.
The execution model is designed around the assumption that credentials and session data are yours and should never leave your control. Here's exactly what goes where:
Integration definitions — the step-by-step request logic we've built and maintain. Never exposed to the agent or caller. Executions are logged with inputs scrubbed of credential fields.
Session cookies, auth tokens, CSRF tokens, and API credentials. Stored in ~/.unrested/sessions/ and injected at runtime. Never transmitted to our infrastructure.
Our hub sends one bare HTTP request at a time to your agent over TLS. The agent executes it and returns the result. The hub never sees your session data — only the outbound request structure and the scrubbed response.
Per-user execution for audit compliance. Each team member runs their own agent with their own credentials. Portal audit logs record each individual's authenticated identity — not a shared service account. This satisfies audit attribution requirements for HIPAA, 21 CFR Part 11, SOX, and state-regulated workflows.
Enterprise customers can run the entire Tixl stack inside their own infrastructure — no data leaves the network, no cloud dependency. We ship pre-built Docker images; no source code is required or provided.
docker-compose.yml
services:
hub:
image: unrested/hub:latest
environment:
SECRET_KEY: ${SECRET_KEY}
DATABASE_URL: ${DATABASE_URL}
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
ports:
- "8000:8000"
dashboard:
image: unrested/dashboard:latest
ports:
- "80:80"
- "443:443"The agent image (unrested/agent:latest) runs on any machine inside your network that needs to execute portal requests — workstations, servers, or VMs with the relevant network access.
On-premises deployment is available on the Scale plan. Integration definitions are delivered to your hub at deployment and updated by us. Contact us to discuss air-gapped installation requirements.
The agent is a lightweight process — about 15 MB — that runs on any machine in your network and executes HTTP requests on demand. It receives one step at a time from the hub over a WebSocket. The integration logic never leaves our servers; the agent only ever sees individual HTTP requests.
Install
pip install tixl-agent
Start
tixl start --token=YOUR_AGENT_TOKEN
Get your agent token from the Agents page. Run this on any machine that needs to make requests — the machine that has network access to the target portal. The token persists across restarts; subsequent runs need no flags.
For portals that require login, each user authenticates once via our browser extension. The session is stored only on their machine. CSRF tokens are auto-detected and injected at runtime — users never manage them manually. Session expiry is handled gracefully: when credentials expire, the user re-imports. The integration definition itself never changes.
Install the browser extension
Add the Tixl extension to Chrome. It captures cookies — including HttpOnly — that browser DevTools can't reach.
Log in normally
Navigate to the portal and authenticate as you normally would. SSO, MFA, and proprietary login flows all work.
Export the session
Click the Tixl extension icon and export. The session file is saved to your machine only — never uploaded anywhere.
Import it
Run: tixl import ~/Downloads/portal.json — the integration now executes under your credentials automatically.
Sessions expire when the portal invalidates them — typically days to weeks depending on the portal's policy. Re-import when credentials stop working. Everything else is unchanged.
Tixl is a native MCP server. Claude, Cursor, and any MCP-compatible agent can discover available integrations as tools via tools/list and call them via tools/call — no custom wiring, no schema management.
Claude Desktop / Cursor (stdio)
# ~/.claude/claude_desktop_config.json { "mcpServers": { "tixl": { "command": "tixl", "args": ["mcp"], "env": { "TIXL_API_KEY": "unr_your_api_key" } } } }
SSE transport (server-side agents)
https://api.tixl.ai/mcp/sse?api_key=unr_your_api_keyAuth parameters (cookies, session tokens, CSRF) are stripped from the tool schemas exposed to the agent — the agent only sees business parameters like {"customer_id": "ACM-4821"}. Auth injection happens server-side and on your machine, invisible to the agent.
Authentication
Authorization: Bearer unr_your_api_keyExecute an integration
curl -X POST https://api.tixl.ai/api/v1/claims-portal \ -H "Authorization: Bearer unr_your_api_key" \ -H "Content-Type: application/json" \ -d '{"customer_id": "ACM-4821"}'
Response:
{
"execution_id": 8421,
"status": "completed",
"duration_ms": 4200,
"data": { /* structured result */ }
}CLI reference
| tixl start --token=TOKEN | Connect this machine as an execution agent. Token persists — run without flags on subsequent starts. |
| tixl call | Call an integration. Add -p key=value per parameter. |
| tixl call | Batch run — one row per call, results exported to .xlsx. |
| tixl mcp | Start local stdio MCP server for Claude Desktop / Cursor. |
| tixl import file.json | Import a browser session exported from the extension. |
| tixl login | Capture session cookies for a domain from the current browser. |
| tixl sessions | List saved sessions on this machine. |
Error codes
| 401 | Missing or invalid API key. |
| 404 | No integration with that slug. |
| 422 | Missing or invalid parameters. |
| 429 | Monthly credit limit reached. |
| 502 | The upstream portal call failed after retries. |
| 503 | No agent connected. Run: tixl start --token=TOKEN |
Integrations are defined once and shared across your organization. Each team member runs their own agent and imports their own credentials — execution is always scoped to the individual caller. No shared service accounts, no shared session tokens, no compliance exceptions.
1.Go to Team in your dashboard and create your organization.
2.Invite team members by email. Assign admin or member role per person.
3.Integrations assigned to your organization appear in each member's private catalog. Public integrations are also available.
4.Each member runs tixl start on their own machine and imports their own browser session. Their calls execute from their machine, with their credentials, from their IP. The portal audit log records their identity.
We build and maintain integrations for enterprise clients. Tell us which portal, ERP module, or government system you need automated — carrier portal, legacy claims system, state regulatory database, proprietary procurement platform. We'll scope the work and let you know if we've already built it or seen it before. Most integrations are ready within a week.
Book a scoping callFor technical questions, integration requests, deployment assistance, or access issues — reach us directly. Enterprise clients get a dedicated Slack channel.
info@tixl.ai