llms.txt
Compare with other sites' llms.txt files →# Factory
> Factory is the agent-native software factory: a system for delivering production software with AI agents (Droids) that plan, build, review, and ship under human direction. Factory ships the Droid CLI, the Factory desktop and web apps, Droid Computers, Missions, and an enterprise platform used by financial services, defense, healthcare, telecom, and technology teams.
Primary product: [Factory Droid](https://factory.com) - autonomous coding agent available via CLI, web, desktop, Slack, Jira, and Linear surfaces.
## When to use Factory
Use Factory for software engineering work with a clear outcome that can be verified in a repository, issue tracker, terminal, or CI pipeline. Best-fit jobs include implementing scoped features, fixing bugs, reviewing pull requests, generating and running tests, investigating incidents, maintaining documentation, and automating recurring delivery workflows.
Choose an execution surface based on the job:
- Use the Droid CLI for interactive engineering work in a local repository or headless execution in CI.
- Use Missions for long-running, multi-phase work that needs planning, worker coordination, validation, and human checkpoints.
- Use Automations for scheduled or event-driven work triggered by systems such as Slack or GitHub.
- Use the Factory Public API when software needs typed programmatic access to sessions, computers, automations, organization usage, service accounts, or wikis.
## How agents should call Factory
- Read [the documentation index](https://docs.factory.com/llms.txt) first, then fetch the task-specific `.md` page it links to.
- Discover API operations from [the OpenAPI specification](https://factory.com/openapi.json). Every operation has a unique `operationId`, typed parameters and responses, and a description.
- Authenticate Public API requests with `Authorization: Bearer $FACTORY_API_KEY`. Create keys in [Factory API Keys settings](https://app.factory.ai/settings/api-keys), and store them securely before making requests.
- Send `Accept: text/markdown` when retrieving the Factory homepage or an unknown path for a compact Markdown response.
## Website API errors
The Factory Public API runs on api.factory.ai. On the marketing website, unknown /api paths and partner application errors return RFC 9457 application/problem+json with code and hint extensions. Partner errors retain the existing error field.
POST /api/partners reports its actual per-instance, per-IP limit in RateLimit and RateLimit-Policy structured fields (IETF RateLimit draft): five requests per ten minutes. Local 429 responses include Retry-After in seconds; valid upstream Retry-After values are preserved when supplied. Honor Retry-After before retrying, or use exponential backoff when absent. These counters do not describe an API-wide quota.
## Articles
> Long-form guides and comparisons on software factories, AI coding agents, and the Droid platform. Articles are not linked from the main navigation but are individually indexed.
- [CVE explained: what PHP2Shell tells security teams](https://factory.com/articles/cve-explained): CVE explained through the PHP2Shell vulnerability. Learn what a CVE is, how CVSS, KEV, and EPSS help teams decide what to fix first, and how enterprises can shorten the time from a published CVE to...
- [Codex credits, API keys, and the Factory bill](https://factory.com/articles/factory-codex-token-efficiency): One Codex bug fix priced with ChatGPT credits, an API key, and Fast or Ultrafast speed, then on Factory with BYOK or managed models. Worked arithmetic from published rates, plus Factory benchmark d...
- [Pricing one Cursor agent run against Factory](https://factory.com/articles/factory-cursor-token-efficiency): Cursor bills agent runs from a weekly pool, at API list price, or with a per-token rate on Teams BYOK. One agent run priced across those paths and Auto modes, compared with Factory model multiplier...
- [What the PHP vulnerability means for enterprise](https://factory.com/articles/php-vulnerability-enterprise): The PHP2Shell vulnerability lets attackers run code on unpatched PHP servers. Here is what enterprise teams should patch first, what to do about old PHP versions, and how to move from advisory to m...
- [Factory vs Devin: Droid workflows, privacy, and deployment](https://factory.com/articles/droid-vs-devin-enterprise-workflows): Factory vs Devin compared. See how Droid vs Devin differ on delegated work, CI, model choice, data flows, retention, and private or airgapped deployment.
- [Factory vs Cognition for enterprise agent controls](https://factory.com/articles/factory-vs-cognition-enterprise-controls): Compare Factory vs Cognition on administering Droid and Devin: user access, model policy, command permissions, automation ownership, and audit records.
- [Backup recovery tests for agent-generated services](https://factory.com/articles/backup-recovery-testing-coding-agents): Backup recovery testing for coding agent changes verifies restore procedures, integrity, dependencies, and recovery objectives with reviewable evidence.
- [How to test Content Security Policy changes](https://factory.com/articles/content-security-policy-testing-coding-agents): Content Security Policy testing confirms that a page loads approved resources and the browser blocks the rest. Learn how to test directives, nonces, and report-only rollout on agent-written web cha...
- [CORS testing for agent-generated web services](https://factory.com/articles/cors-testing-agent-generated-services): CORS testing checks which browser origins can read an API. Cover allowed origins, preflight, credentials, caching, and failures when an agent edits CORS rules.
- [How to run personal agents securely at work](https://factory.com/articles/model-agnostic-openai-dots-alternative): Personal agents need identity, permissions, and audit at work. See how Factory runs delegated and automated agent work under organization controls.
- [The multi-agent architecture behind reliable missions](https://factory.com/articles/multi-agent-architecture-missions): Luke Alvoeiro explains the multi-agent architecture behind Factory Missions. Explore planning, independent validation, structured handoffs, and selective parallelism.
- [OpenAI dots, Factory, and other agents compared](https://factory.com/articles/openai-dots-vs-factory): Compare OpenAI dots, Factory, and personal agents like Claude Duet, Grok Bot, and Meta Muse on coding, cloud computers, background work, models, and approvals.
- [Recursive self-improvement needs a better measure](https://factory.com/articles/recursive-self-improvement-matan-interview): Matan Grinberg discusses recursive self-improvement and AI adoption with Sabrina Halper. Separate model improvement, engineering feedback, token spending, and useful outcomes.
- [Session cookie tests for coding agent changes](https://factory.com/articles/session-cookie-testing-coding-agents): Session cookie testing for coding agent changes verifies scope, transport protections, expiration, rotation, and logout behavior across application routes.
- [Tenant isolation tests for coding agent changes](https://factory.com/articles/tenant-isolation-testing-coding-agents): Tenant isolation testing for coding agent changes verifies authorization, storage boundaries, cache keys, and background jobs before shared services ship.
- [OpenAI dots vs coding agents for engineering teams](https://factory.com/articles/what-are-openai-dots): OpenAI dots are always-on personal agents. See how they work, how they differ from coding agents like Droid, and what engineering teams need at work.
- [API rate limit tests for agent-generated services](https://factory.com/articles/api-rate-limit-testing-coding-agents): API rate limit testing for coding agent changes verifies quotas, 429 responses, retry guidance, and recovery before a service reaches production.
- [Which AI coding agent is best for your team?](https://factory.com/articles/best-coding-agent-for-your-team): Compare AI coding agents by completed work, workflow fit, model flexibility, and verification. Use dated benchmark evidence and current vendor documentation to define a fair trial.
- [How to test file upload security in agent code](https://factory.com/articles/file-upload-security-testing-coding-agents): File upload security testing checks every stage from receiving bytes to serving them again. Learn the type, size, storage, cleanup, and authorization tests to require on agent-written upload code, ...
- [How to test for memory leaks in agent-written services](https://factory.com/articles/memory-leak-testing-agent-generated-code): Memory leak testing runs the same workload in repeated batches and checks whether retained memory keeps growing after warm-up. Learn how to build the test, read heap snapshots, and give coding agen...
- [How to test for SSRF in agent-written request code](https://factory.com/articles/ssrf-testing-coding-agent-changes): SSRF testing checks that user-supplied URLs cannot reach internal or reserved addresses. Learn the redirect, DNS, and allowlist tests to run on agent-written request code, and how Factory security ...
- [How to catch telemetry schema breaks in CI](https://factory.com/articles/telemetry-schema-checks-coding-agents): Telemetry schema checks validate span, metric, and log attribute names, types, cardinality, and privacy before export. Learn how to version a local schema, test emitted telemetry, and have Factory ...
- [What is the best harness for AI coding?](https://factory.com/articles/terminal-bench-agent-comparison): Compare AI coding harnesses using task completion, model flexibility, verification, and cost, with dated Terminal-Bench results and Factory’s routing research.
- [Authorization tests for coding agent changes](https://factory.com/articles/authorization-testing-coding-agent-changes): Authorization tests for coding agent changes require denied-path coverage, object-level cases, policy fixtures, and evidence at the enforcement point.
- [How to test concurrent code for races and deadlocks](https://factory.com/articles/concurrency-testing-coding-agent-changes): Concurrency testing combines race detectors, controlled execution orders, invariant checks, and stress runs. Learn how to scope a test around shared state, reproduce a race, and review agent-writte...
- [How to make queue consumers safe for duplicate delivery](https://factory.com/articles/queue-consumer-safety-coding-agents): Queue consumer safety depends on idempotent side effects, a correct acknowledgment point, bounded retries, and dead-letter handling. Learn the failure-injection tests to require on agent-written co...
- [How to test time zone and DST bugs in agent code](https://factory.com/articles/time-zone-testing-agent-generated-code): Time zone testing should cover daylight saving transitions, ambiguous and missing local times, time zone database updates, and an injectable clock. Learn the test matrix to require on agent-written...
- [How to test webhook signature verification in agent code](https://factory.com/articles/webhook-verification-coding-agents): Webhook signature verification fails when code parses the body before checking the HMAC. Learn the raw-body, replay, and secret rotation tests to require on agent-written handlers, and how Factory ...
- [How to review database query plans in agent PRs](https://factory.com/articles/database-query-plan-review-coding-agents): Database query plan review compares the old and new plan for the same query, parameters, and data shape before merge. Learn when to use EXPLAIN or EXPLAIN ANALYZE, how to spot estimate errors, and ...
- [How to validate Kubernetes manifests before rollout](https://factory.com/articles/kubernetes-manifest-validation-coding-agents): Kubernetes manifest validation should render the final objects, run server-side dry run against a matching API server, check field ownership with server-side apply, and keep rollout with reviewers....
- [How to test log redaction in agent-written code](https://factory.com/articles/log-redaction-coding-agents): Log redaction keeps tokens and personal data out of logs, traces, and error reports. Learn how to inventory sinks, test the final emitted record with canary values, and use Factory security review ...
- [How to keep Protobuf changes backward compatible](https://factory.com/articles/protobuf-compatibility-coding-agents): Protobuf compatibility depends on field history, reserved numbers, generated clients, and mixed-version rollout. Learn which schema changes are safe, how to test old and new clients both ways, and ...
- [Retry safety: idempotency, backoff, and agent code](https://factory.com/articles/retry-safety-agent-generated-code): Retry safety means a retried call cannot duplicate side effects or multiply load. Review idempotency, retry ownership, backoff, and deadlines in agent code.
- [How to regenerate API clients without breaking callers](https://factory.com/articles/api-client-generation-coding-agents): API client generation should start from a reviewed OpenAPI contract, use a pinned generator, prove the output is reproducible, and compile real consumers before release. Learn the workflow for agen...
- [Build provenance for coding agent artifacts](https://factory.com/articles/build-provenance-coding-agent-artifacts): Build provenance links an artifact to its source, workflow, and inputs. Generate SLSA attestations in trusted CI and verify them before releasing agent-built code.
- [Code ownership for coding agent pull requests](https://factory.com/articles/code-ownership-coding-agent-pull-requests): Code ownership routes coding agent pull requests to people who understand the affected systems. Keep ownership rules current, specific, and protected.
- [How to harden container images without breaking them](https://factory.com/articles/container-image-hardening-coding-agents): Container image hardening works best one finding at a time. Learn how to scope an agent task from a scanner result, rebuild and scan the new digest, run the production entrypoint, and review the ch...
- [Keeping test data private with coding agents](https://factory.com/articles/test-data-privacy-coding-agents): Test data privacy for coding agents requires approved fixtures, restricted access, and checks that prevent sensitive records from entering prompts, logs, or commits.
- [Accessibility testing with coding agents](https://factory.com/articles/accessibility-testing-coding-agents): Accessibility testing with coding agents combines deterministic scans, keyboard flows, semantic inspection, and human review. Build useful evidence into every UI change.
- [Agent readiness: fix the repos slowing your rollout](https://factory.com/articles/agent-readiness-rollout): Use agent readiness to find the repositories blocking an AI rollout, prioritize fixes, and measure progress with Factory’s reports and dashboard.
- [Agent readiness can cut repeated token work](https://factory.com/articles/agent-readiness-token-efficiency): Agent readiness exposes avoidable setup, search, and validation work. Connect repository improvements to token efficiency without inventing a savings benchmark.
- [How to write an AGENTS.md file, with an example](https://factory.com/articles/agents-md-guide): An AGENTS.md file tells coding agents how to work in your repository. Learn how to write one with verified commands, scope boundaries, and completion checks.
- [AI agent controls for private development networks](https://factory.com/articles/ai-agent-controls-private-networks): AI agent controls for private networks need enforceable permissions, sandboxing, managed model policy, and review gates. Build a testable policy for Droid.
- [Protecting API compatibility with coding agents](https://factory.com/articles/api-compatibility-coding-agents): API compatibility checks help coding agents change services without surprising consumers. Compare contracts, trace callers, and validate old and new behavior.
- [Model routing has to account for the warm cache](https://factory.com/articles/cache-aware-model-routing): Model routing can lose its price advantage when a switch discards cached context. Factory’s research explains why task state belongs in the decision.
- [Audit trails for coding agent changes](https://factory.com/articles/coding-agent-audit-trails): A coding agent audit trail connects identity, intent, tool activity, validation, review, and deployment. Learn what evidence to retain without collecting unnecessary data.
- [Configuration drift repair with coding agents](https://factory.com/articles/coding-agent-configuration-drift): Configuration drift repair with coding agents starts from approved baselines, separates evidence from fixes, and keeps changes reviewable.
- [Context compaction must preserve the next step](https://factory.com/articles/coding-agent-context-compaction): Context compaction shrinks a long agent session so work can continue. See what it must keep, and what Factory's study of 36,611 session messages found.
- [Safer database migrations with coding agents](https://factory.com/articles/coding-agent-database-migrations): Database migrations with coding agents need staged schema changes, compatibility tests, rollback evidence, and human approval without hiding operational risk.
- [Safer dependency updates with coding agents](https://factory.com/articles/coding-agent-dependency-updates): AI dependency updates need more than a version bump. Scope compatibility work, inspect transitive changes, run focused tests, and keep every update reviewable.
- [Removing stale feature flags with coding agents](https://factory.com/articles/coding-agent-feature-flag-cleanup): Feature flag cleanup requires proof that a flag is stale. Coding agents can remove the obsolete branch and evaluation call while testing the permanent behavior.
- [Localization testing with coding agents](https://factory.com/articles/coding-agent-localization-testing): Localization testing with coding agents checks translated interfaces for layout, formatting, direction, missing messages, and functional regressions.
- [Coding agent observability that reviewers can verify](https://factory.com/articles/coding-agent-observability-changes): Coding agent observability work needs stable signal names, bounded cardinality, and behavioral evidence. Learn how to review instrumentation changes.
- [Coding agent productivity metrics that matter](https://factory.com/articles/coding-agent-productivity-metrics): Coding agent productivity metrics should connect cost and usage to delivery, quality, and business priorities. Measure outcomes without rewarding code volume.
- [How to run a runtime upgrade with coding agents](https://factory.com/articles/coding-agent-runtime-upgrades): A runtime upgrade starts from a supported target and a passing baseline. Learn how to find every version selector, repair one compatibility class at a time, validate the deployed artifact, and use ...
- [Coding agent task specifications that work](https://factory.com/articles/coding-agent-task-specifications): A coding agent task specification needs a bounded outcome, repository context, acceptance criteria, and verification steps. Use this practical structure for delegated work.
- [Test fixture maintenance with coding agents](https://factory.com/articles/coding-agent-test-fixture-maintenance): Test fixture maintenance with coding agents can remove hidden dependencies, reduce setup cost, and preserve the behavior each test proves.
- [Visual regression testing with coding agents](https://factory.com/articles/coding-agent-visual-regression-testing): Visual regression testing with coding agents combines stable screenshots, targeted interaction, and human review of intentional UI changes.
- [Coding agents in monorepos, with clear boundaries](https://factory.com/articles/coding-agents-in-monorepos): AI coding agents in monorepos need explicit package boundaries, local instruct
