Cockpit
Muse for Mule.
A chat console where a developer connects their Salesforce, MuleSoft, GitHub, Slack and Postman. The Copilot reads them and, with your approval, changes them.
Sign in with Google or Apple. A new account starts in Sandbox, which is read-only.
Invitation-only beta
01 / WHAT COCKPIT IS
One chat for the systems you work in
You open Cockpit, connect the systems you work in, and ask questions in plain English. The Copilot answers from the systems themselves: it looks up the objects, classes, flows, APIs, repositories, channels and collections you ask about, using the connections you made.
When an answer calls for a change, the Copilot does not make it. It proposes it on an approval card that names where the change would land, and nothing happens until you press Approve. Each connection acts as you, so the Copilot can only see what you can see.
Salesforce
- Reads
- Objects and fields, Apex, flows, limits, permissions and records.
- Changes
- Create and update a record, in Production mode, on an approval card that names the org.
MuleSoft
- Reads
- Applications, APIs and environments in your Anypoint organisation.
- Changes
- Read only.
GitHub
- Reads
- Repositories, code, pull requests, issues and Actions runs.
- Changes
- Open a pull request, in Production mode, on an approval card that names the repository and branch.
Slack
- Reads
- Channels, threads and search.
- Changes
- Post a message, in Production mode, on an approval card that names the workspace.
Postman
- Reads
- Workspaces, collections, environments, monitors and mocks.
- Changes
- Read only.
Production write tools are being switched on one connector at a time. Until a connector's write is on for your account it only reads, whatever mode you choose.
02 / HOW COCKPIT WORKS FOR AN ENTERPRISE
How Cockpit works for an enterprise
Diagram. On the left, the ways you use Cockpit: web and tablet, Mac, Windows, with iPhone and Android coming. In the middle, the Cockpit brain, which runs the Copilot on Claude as its engine. On the right, the five systems the brain reaches with your connections: Salesforce, MuleSoft, GitHub, Slack and Postman.
INTERFACES
- Webany browser, tablet included
- Macapp, private beta
- Windowsapp, private beta
- iPhonecoming
- Androidcoming
CONNECTORS
- Salesforce
- MuleSoft
- GitHub
- Slack
- Postman
One request, step by step
- 01
You ask
In the web console or the Mac or Windows app. Every screen talks to the same Cockpit brain, so your chats and connections are the same on each.
- 02
The Copilot plans
The brain gives your question and the tools on offer to Claude, which is the engine behind the Copilot, and Claude decides which tools to call. Which tools are on offer depends on your mode, below.
- 03
Tools read
The brain calls the connected system with your stored connection and returns only what the answer needs.
- 04
A change waits
A write is never made by the Copilot directly. It becomes an approval card showing the exact change and the org, workspace or repository it lands in.
- 05
You decide
Approve and the brain re-checks your mode, then applies the change and records it. Deny and nothing is written.
Two ways to connect a tool
Quick connect
Sign in to the tool and grant access to a Cockpit-owned app. The connection acts as you.
Bring your own app
Use an app or key that your own organisation created instead.
Connections belong to your account, not to a device, so web, Mac, Windows and, later, phones share them.
03 / SAFETY MODEL
What the Copilot may do, and who decides
Sandbox is read-only
A new account starts in Sandbox. In Sandbox the brain does not offer any write tool to the Copilot, and the tool executor refuses a write even if one were asked for.
Production writes need approval
You choose Production mode yourself, per account, per provider or per chat, and the strictest setting wins. Even then every write stops at an approval card that names the Salesforce org, Slack workspace or GitHub repository it will land in, and the approval is bound to that target.
Enforced on the server
The mode is frozen when a run starts, checked again at the moment you approve, and recorded with refusals. The switch you see in the screen is a view of the setting, not the guarantee.
Credentials are encrypted
The access Cockpit holds for your tools is stored encrypted. Disconnecting a tool revokes Cockpit's grant at the provider.
One AI provider
Anthropic is the only AI provider. What you ask and what your tools return are processed by Claude to write the answer. You agree to this before first use, and the privacy policy has the details.
You can leave
Delete your account in the app, and your data and the Salesforce grants go with it.
One thing to know before you connect a real system: Cockpit connects with the credential you give it. Sandbox is Cockpit declining to write, not a read-only credential at the provider. That is why the test drive below starts with throwaway accounts.
04 / TEST DRIVE
Try it on accounts that hold nothing
Before you connect anything real, make free accounts that hold nothing of value, connect those, and see what the Copilot does with them. Connect your real systems only afterwards.
- 01
Make the accounts
A public Gmail address, then free throwaway accounts: a Salesforce Developer Edition org, a Slack workspace, a MuleSoft trial, a Postman account and a GitHub account.
- 02
Request access and sign in
Ask for access below. Once you are approved, sign in with the same Google or Apple account.
- 03
Connect and ask
Connect the throwaway accounts, stay in Sandbox, and ask about them. Then switch one to Production and watch an approval card name its target before anything is written.
- 04
Connect the real ones
When you trust what you saw, connect your real systems the same way.
The Flight Deck Manual walks through each step with screenshots: Open the Flight Deck Manual.
05 / TEAMS
Captain and Crew
Arriving. The first team is being set up by hand.
For an enterprise, one person leads and the rest work. The Captain is the team's admin; everyone else is the Crew. The Copilot works for each member exactly as it does for an individual.
A Captain and a Crew
The Captain invites the Crew by email, any number of people. Each member gets their own sign-in. There is no company directory or single sign-on.
Access per member, per connector
For each member the Captain sets none, read or write on each connector. One person can have everything, another Salesforce only, another Salesforce and MuleSoft. The smaller of that grant and the Sandbox or Production mode applies, and it is enforced in the brain, not in the screen.
What the Captain sees
Who is on the team, what each member may use, which providers each has connected, and a plain log of who did what, when, on which connector. Never a member's chat text.
Members approve their own writes
A member approves their own Production writes. The Captain decides whether a member can write at all.
Leaving is immediate
Removing a member cuts their access at once and revokes their connections.
Nothing shared yet
In the first version connections, chats and AI budgets stay per member.
A team starts with a request. The owner approves it and creates the first Captain by hand. To begin, write to support@cockpitai.io.
06 / FOR INDIVIDUAL DEVELOPERS
For individual developers
One developer, one account, your own Google or Apple sign-in, your own connections. The same Copilot, the same Sandbox and approval cards. No team features.
Individuals
$250 per month
One plan.
Teams
Contact us
Priced per team.
There is no online checkout. Request access and we will write to you.
07 / REQUEST ACCESS
Join the waitlist
Leave your work email and we will write when your invite is ready. We use it for nothing else.
We use what you give us only to decide who to invite and to write to you about Cockpit. No spam, and we never sell it. Details are in the privacy policy.
Join the first developers