Overnight SDK
The SDK loads into your model as context and hands it the capabilities you approved. Anything outside that list never compiles, so the mistake lands on a laptop hours before production is in the picture.
The failure lands on a laptop.
The manifest isn’t documentation. It’s the list the compiler checks against, so code reaching for something you never granted stops there, before a key is loaded and before a request is made.
The Overnight SDK is the model-facing layer of a compliant runtime: it loads into an AI model as context and gives it approved, brokered capabilities in place of raw credentials.
Your model doesn’t have to be trusted for this to hold. It asks for a capability, the SDK hands back a handle, and the raw credential stays somewhere the model can’t see.
- 01 capabilities
Your model works from a list you approved
The SDK loads into your model as context and hands it a set of approved capabilities: brokered, scoped actions standing in for raw credentials. Your model asks for the customer table and gets a handle to it. The key behind that handle never enters the model’s context, so it can’t be echoed into a log, written into a file, or talked out of the model by a crafted prompt.
That turns "the model can do anything the token allows" into "the model can do what you approved." It earns its keep on the small stuff most of all: the quick data script nobody would call an application is exactly where someone would otherwise paste a production credential into a file.
- 02 the manifest
Code outside the manifest doesn’t compile
Every app declares what it’s allowed to touch. That declaration isn’t documentation sitting next to the code, it’s the list the compiler checks against, so a call reaching for something you never granted fails the build.
The unauthorized action goes unrepresented, which is how capability-based security is meant to work. There’s no runtime denial to log and no policy engine to consult, because the code expressing that action was never valid in the first place.
- 03 where it fails
The mistake lands on a laptop, hours before production
Failures arrive at compile time, on the machine of whoever is building. No review queue to join, no staging incident, no security ticket, because the thing that would have caused all three never built.
Your model doesn’t have to be trustworthy for this to hold. It asks for a capability, the SDK hands back a handle, and the credential stays somewhere neither the model nor the code it wrote can see.
- 04 any model
Point Cursor, Claude, or your own agents at it
The SDK shapes what those tools are allowed to generate without changing how your team likes to build. Keep the editor, keep the model, keep the workflow. Your engineers shouldn’t have to learn a new way to write software in order to be allowed to ship it.
Overnight deliberately isn’t trying to be your code generator. Generation is cheap and getting cheaper, and the tools your team already likes are good at it. The scarce thing is somewhere the output can safely run.
- 05 the handoff
The Runtime enforces the same boundary again
Whatever the SDK produces is sealed and handed to the Overnight Runtime, which checks it at execution time against the same manifest that governed the build. One boundary, declared once, enforced twice.
The two cover for each other on purpose. If a piece of code somehow skips the SDK, the Runtime still holds the line, because enforcement lives at the hardware, network, and operating-system layers underneath the workload instead of in a library the code chose to import.
How the Runtime enforces it → - 06 what stays yours
Your apps are ordinary code you can take with you
What comes out is your own source, in the languages and frameworks your team already uses, written against capabilities you granted. There’s no proprietary app format to get stuck inside.
It leaves with you if you go. What doesn’t travel is the enforcement, which was never implemented inside the applications to begin with.
A safer surface to build on.
Tell us what you are building and we will get you into early access.