Reference
Comparison
NILScript is the governed action layer for AI agents. MCP and OpenAPI are integration layers that standardize what an agent can reach; guardrails are probabilistic filters over an action the agent can already name; OAuth is the closest analogy, server-side authorization for writes. NIL is none of these, and it composes with them rather than replacing them.
Standard vs product
The distinction that matters most is what the spec guarantees versus what you build yourself. NILScript defines a wire protocol and a DSL that any conformant system can implement; it is not something you run.
Capability matrix
| Capability | Raw APIs | MCP / function calling | n8n / Zapier | NILScript |
|---|---|---|---|---|
| Neutral across backends | No | Partial | Partial | Yes |
| Agent-authored at runtime | No | Yes | No | Yes |
| Preview before side effect | No | No | No | Yes |
| Tiered human approval | DIY | DIY | Manual nodes | By spec |
| Idempotency + audit by spec | No | No | Varies | Yes (G4, G6) |
| Safe by construction | No | No | Partial | Yes |
| Intent, not implementation | No | Partial | No | Yes |
| Durable execution | No | No | Yes | Yes |
| Governed reversal by spec | No | No | Partial | Yes |
NILScript, MCP, guardrails, and OAuth
MCP / OpenAPI / function-calling are integration layers. They describe a surface so a client can discover and call it; the agent still authors the call. NIL sits underneath the effect and governs it: it removes the agent’s ability to author an undeclared call at all. An agent can use MCP to read context and NIL to act on it, under a scoped grant with a preview the owner approves. NIL composes with MCP; it does not replace it.
Guardrails are probabilistic filters. A classifier or policy prompt inspects an action the agent can already name and blocks it with some probability. Under NIL the unauthorized action is not namable, so the rate is zero by construction within the threat model, not small by tuning. NIL is a single structural boundary, not a per-step filter.
OAuth is the closest correct analogy. NIL is authorization for agent writes, enforced at the effect boundary on the server, independent of the model. It does not make the model correct or the agent wise; it makes the unauthorized action uncommittable.
vs workflow tools
Workflow tools are products where a human designs flows ahead of time in a GUI. NILScript is a specification where an agent authors flows at runtime as validated DSL programs.
| n8n / Zapier / Make | NILScript | |
|---|---|---|
| Who authors the flow | A human, ahead of time | An agent, at runtime |
| What it is | A hosted product | An open spec + reference |
| Backend coupling | Per-connector | Any conformant system |
| Safety model | Manual approval nodes | Tiers, previews, grants by spec |
| Failure recovery | Engine-dependent | Durable; non-determinism quarantined |
If flows are fixed and human-designed, a workflow tool is the right call. NILScript exists for when an agent decides what to do at runtime and it still must be safe, previewable, and auditable.
vs raw APIs
Raw APIs give maximum power and zero guardrails — and connecting M agents to N systems is the M×N problem, with hallucinated amounts going straight through. Hardcoded workflows are safe but rigid, encoding only the flows you anticipated, for one backend. NILScript collapses the false choice: an agent authors a plan at runtime (flexibility), and validation, two-phase commit, scoped grants, and tiered approval keep it safe.