The user guide

How to use AgentsPoppy

Every screen you'll meet, from download to your first running poppy. The app is free, the one-time AWS setup takes about three minutes, and nothing below ever asks for — or uses — admin access to your cloud.

Building apps instead? That path lives in the developer hub.

1. Install it and open it

   Download AgentsPoppy for macOS, Windows, or Linux — it's free, with no account to create. The first launch introduces the one idea everything else rests on: AgentsPoppy is the gatekeeper between your apps and your own AWS. Apps never hold your keys; they get scoped, short-lived credentials that expire within the hour, and you can switch any of it off whenever you like.

   

2. Connect your AWS — even if you've never had one

   Poppies run in your Amazon Web Services account, so you need one. No AWS yet? The app walks you to Amazon's own signup — creating an account is free, new accounts get free credits, and plenty of the Free Tier stays free permanently. You'll enter a card for identity verification; Free-Tier usage isn't charged.

   

   

   Already have AWS? Then you make one dedicated, least-privilege access key — never your account root. The app links you straight to the right console page and to a scoped policy you can attach as-is: it lets the one-time setup create AgentsPoppy's own role and operator, and nothing else, and you can revoke it any time.

   

3. Create the broker role — yours, not ours

   This is the step that makes AgentsPoppy different. You create the broker role in your own account (one click on “Automated”, or a manual path if you want to read every line first). AgentsPoppy only ever assumes a role you made — it never receives a key, so it can't grant itself anything, and turning it off is entirely in your hands.

   

   

   The last step is a single “Verify connection” button: a safe check where AgentsPoppy assumes your role once to confirm everything lines up. Nothing is created or changed — you just get a green tick, and you're in.

4. Install a poppy from the catalogue

   The Poppies tab is the app store — except every listing links its open repository, so you (or your AI agent) can read exactly what a poppy does before it ever touches your cloud. Pick one, press Install, done.

   

   The first time a poppy wants to use its connection, AgentsPoppy stops and asks you — Approve or Deny, in plain language, with every requested power rated green, amber, or red. Nothing runs until you say yes, and you can pause or revoke a poppy's access at any time.

5. Use it like any other app

   A running poppy is just an app — inbox, dashboard, buttons — with one difference you can see in its title bar: Sandboxed · own resources only. Its backend lives in your account, its data stays in your account, and where costs exist they're counted in front of you.

   

6. See everything it built — and tear it down in one click

   Open any poppy on the Dashboard and you get the view no ordinary app store can give you: a live map of what it actually built in your cloud, service by service, plus every power it holds — each one labelled “Its own” (scoped to resources it created) or “Broad” (and then read-only). Done with it? “Tear down everything it built” removes the lot. No zombie servers, no surprise bill.

   

7. Audit updates before they run — with your own AI

   This is the part no other app platform does. When an update ships, AgentsPoppy doesn't auto-install it — it shows you Review and update. Reviewing reads the open source; nothing is downloaded to your computer until you choose to install.

   

   One click on “Verify this update with your AI agent” copies a prompt — written by AgentsPoppy, not by the app being audited — that has your own AI read the source and report anything undeclared or risky: new external calls, credential access, broader AWS powers.

   

   

   // why this matters

   Every other store asks you to trust an update because someone else reviewed it. Here the reviewer works for you, reads the actual source, and answers to nobody else — and if the verdict is bad, the update simply never touches your machine or your cloud.