Web Daemon

Your business. Your AI.

Web Daemon gives every person, team and system its own daemon: an extremely lightweight web origin with its own identity, data, memory and generative AI. Daemons work together over plain HTTPS using revocable signed grants. There is no central hub, no proprietary runtime and no single vendor holding the keys.

Get started How it works

Three architectural principles

Most enterprise AI means sending your data to one vendor's platform and building on its terms. Web Daemon starts from the opposite end.

Decentralised by design

Each daemon is a separate party on its own hostname, with its own keys, storage and memory. One deployment hosts thousands of them.
Daemons on different deployments talk to each other seamlessly, exactly as if they shared a server. There's nothing to set up between them: each daemon checks the other's signature against its public key on the web.
Daemons call each other directly with signed tokens. A shared record lives with the daemon that hosts it, and everyone else calls that daemon. Nothing is copied around, so nothing drifts out of sync.
AI memory is isolated per daemon. What one daemon stores is invisible to the others.

Web native

Apps are ordinary HTML, CSS and JavaScript. Build them with any framework and host them anywhere. One <link rel="webdaemon"> element makes a web app a daemon app.
It's built on standards your teams already run: HTTPS, JWK-signed tokens, passkeys (WebAuthn), OAuth, Web Push and the Model Context Protocol.
The browser is the client, so there's nothing to install on devices.

Independent of big tech

You're not tied to one AI provider. Each app picks its model from a catalogue that spans self-hosted and providers, and can switch without being rewritten.
Identity is a domain and keys you control, not an account on someone else's platform.
Security is two-dimensional: every grant says who is asking (their daemon) and in what capacity (the app they're acting through).

Parties, not platforms.

A party can be a person, an AI agent, an internet thing, a company, a department or a team. Every party is a daemon with its own origin - able to handle interactive requests, scheduled tasks and batch operations - and communicating on an equal footing with all other web-addressable systems including centralised SaaS and other daemons, wherever they are deployed.

A traditional web app has a frontend and a centralised backend that every user shares. Web Daemon adds the missing decentralised element: daemon-side code that runs inside each party's own daemon, right next to its data and identity.

Frontend

HTML, CSS and JavaScript in the browser. Use any framework and host it anywhere.

Daemon-side

TypeScript running inside each party's daemon, with its storage, identity and AI memory. It starts on demand and stops when idle.

Static backend

Your existing servers or SaaS services, shared by all users, work as they always have.

Easy to Use

myApp.html

<link rel="webdaemon" href="myApp.yml">

myApp.yml

title: My App
scope:
  greet:
    description: Can receive a greeting
grant:
  ${party}: [greet]
tab:
  v1:
    src: myServer.ts

AI that works from your data, with your permissions

Every daemon comes with an AI subsystem your apps can call. It's part of the infrastructure, not a chatbot added on top: memory, retrieval, agents and tool access, all governed by the same grants as everything else.

Human front end fetch

A browser app, built with any framework and hosted anywhere, calls its daemon over HTTPS with a signed token. This is how people see and use the app.

AI front end MCP

Any MCP client, such as a desktop assistant or another daemon's agent, calls the same daemon. It registers through OAuth with no pre-shared credentials, and sees only the tools it has been granted.

Two front ends, one daemon: build an app's logic once, and offer it to people through the browser and to AI through MCP, under the same grants.

Structured memory

JSON records in named collections, fetched by exact field values, with attachments that live and die with the record.

Drive

Each daemon's own file system, with permissions set per path. Make a folder public and its files are served at a plain URL.

Semantic indexes

Search by meaning over the sources you already trust: records, drive files or a crawled website. Every result points back to its source, and indexes rebuild on demand instead of becoming a second copy that drifts.

Generative agents

Multi-turn agents that use tools: memory, the drive, web search, and the tools of other installed apps.

Agents that build

With the right grants, an agent can use the drive as a workspace: write files, publish shareable pages, and install small utility apps it has written.

AI in multi-party apps

A model can take a participant's place in a shared app, as a stand-in, an opponent or an external client, using its own narrowly scoped tools.

Security enforced at the boundary

The daemon checks each request before your code sees it. That removes whole classes of mistakes from application code.

Signed tokens, fully checked. The daemon verifies expiry, audience, origin (CSRF) and signature, and confirms that every capability the token claims was actually granted.
Two-dimensional grants. Every grant names who is asking (their daemon) and in what capacity (the app they're acting through). The same daemon calling through a different app gets only what it has been granted there.
Revocation is immediate. Owners review and revoke grants in the daemon itself, and revocation takes effect at the boundary straight away.
Sandboxed execution. Daemon-side code runs in Deno with network access only: no disk, no environment variables, no system calls.
Keys, not passwords. Each browser, phone or passkey holds its own key for a daemon, and devices can be added or removed one at a time.
Isolated memory. Each daemon's AI memory is its own and is invisible to other daemons.

Reach systems behind your firewall without opening it

A remote runner is daemon-side code that runs inside your own network, for example a service that queries your company's SQL database. A small Remote Gateway process connects outbound to the cloud and passes requests to the runner. There are no inbound ports to open, and the data stays where it is.

Delivered by Magic ID

Web Daemon is available exclusively through our partner Magic ID. They'll take your technical team through the platform, the security model and how it would sit alongside the systems you already run.

The most experienced Web Daemon team

No one has designed and delivered more Web Daemon solutions than Magic ID, with customers in the UK, Europe and the US.

Business-ready apps

A range of business-level apps, including Magic Expert: a powerful business AI agent that draws on and integrates your marketing, ERP, emails and voice into powerful operational tools for planning and analysis.

Customer engineers

A pool of talented engineers who design and deliver solutions for small, medium and large enterprises alike.

Visit Magic ID info@magic-id.com