A shared drive for AI agents that censors itself per visitor

What it does

Puppyone is a centralized file system—branded a Context Drive—that ingests data from sources like GitHub, Gmail, Google Drive, and web pages, converts it into agent-friendly formats such as Markdown and JSON, and serves it to AI agents through scoped access points. It versions everything with Git-like semantics, tracks audit logs, and handles concurrent edits with checkout and commit workflows. Agents interact with it through a CLI, MCP endpoints, a REST API, sandboxed containers, or a web app, depending on what the tool supports.

The interesting bit

The standout idea is File Level Security (FLS): permissions are enforced at the filesystem layer, meaning an agent’s sandbox or MCP view is physically missing files it lacks access to—row-level security applied to directories rather than database tables. This turns a single shared drive into many filtered realities, which is a more paranoid and arguably more robust approach than simple access-control lists. The README also notes the self-hosted stack mounts the host Docker socket to run sandboxes locally, a convenience the authors explicitly caution against for remote or multi-tenant deployments.

Key highlights

• Connectors for GitHub, Gmail, Google Workspace, web pages, Supabase, and local filesystems normalize data into Markdown/JSON.
• Per-agent file permissions (FLS) enforced at the filesystem layer; unauthorized files simply do not appear in the agent’s environment.
• Git-style versioning with diffs, folder snapshots, rollback, and checkout/commit workflows for concurrent agent editing.
• Multiple access methods: auto-generated MCP endpoints, REST API, CLI, sandboxed Docker/E2B containers, and local folder sync.
• Available as a managed cloud service or a self-hosted Docker stack (Apache 2.0, though trademarks are reserved).

Caveats

• The self-hosted Docker setup shares the host Docker socket with the backend container to enable local sandboxes, which the README itself flags as a security concern for remote or multi-tenant deployments.
• Several features—agent chat and OAuth connectors like GitHub or Gmail—require manual API key configuration in self-hosted mode and do not work out of the box.

Verdict

Teams running multiple AI agents that need shared, auditable context with strict data segregation should look here; if you just need a single chatbot to read a few PDFs, this is over-engineered infrastructure.