Meet BrunoSend a request, commit the collection. No account, no cloud.
Toyo is a personal AI assistant that lives in your messages and can call you on the phone. Talk to it like you'd message a coworker. Toyo triages your inbox, preps you for calls, can help keep your projects moving, and pulls answers and context from your company's tools. It works over text and voice: Have it call you when you want to get updates or just talk through some work. It lives in iMessage, so there's no new apps, and no new tabs to manage.
AgentKey
Toyo
@luki_notlowkey Yes! We are going to continue invest in integration and MCP support to make it easier to connect almost any tool or data source to your Toyo!
Kilo Code
pro tip: follow @Toyo for future launches 👀
Building a group trip planner, so "lives where people already reply" is the whole ballgame for me. When Toyo calls someone's phone, is that a real voice agent talking or just a nudge to open the thread? Curious where a call actually beats a text that gets left on read.
Toyo
@chielephant yeah it's a real voice agent! It has access to all of the same context and memory that Toyo does over text, so you can talk to it the same way as via iMessage.
Voice vs text is a very personal preference but generally I think it's useful when you're on the go. Personally:
I used it a ton when I was exploring Tokyo last month, asking it for recommendations on some sightseeing and actually having it explain to me the difference between some different Pokemon card products I was trying to pick up for a friend's son, lol.
I also have called it a few times when I wanted to brain dump some ideas into a note to turn into a content draft that I could pick up when I was back at my desk.
This is kinda what Apple Intelligence should've been haha. Can you give any insight to how you manage agent context under the hood and any guardrails you had to build to avoid devious things being done with this assistant?
Toyo
@noice30sugar appreciate that! Thank you man.
So, a bit on each piece:
Context: every company gets its own isolated cloud workspace, and Toyo's context is built fresh from it each turn — what it's learned about your business, its memory, and the live thread. When it gets long, Toyo summarizes and hands off to itself instead of forgetting.
Memory isn't a black box! Actually, it's plain ol' markdown in your workspace that Toyo reads and writes. Super simple.
Guardrails are mostly architectural: what 'thinks' — model orchestration, your keys, integrations — runs on @Cloudflare Workers, kept separate from what 'acts': sandboxed, per-company containers that never hold your credentials. Plus per-company isolation, capped spend, and a confirm step before anything irreversible.
On company context + memory specifically: we're running an internal
prototype of something really cool here... watch this space! Can't wait to
share soon.
@aidanhornsby cool stuff man always interesting to see how others tackle unique architectural problems. keep up the great work
Toyo
@noice30sugar thank you man 🙏
One thing that would make Toyo way more useful for me is letting it take notes during my calls and automatically push a summary plus action items to my project board. Right now I still have to recap everything myself after a long call, which defeats the purpose of having it there in the first place.
Toyo
"Triages your inbox" and "pulls context from your company's tools" are the two claims that require the most trust upfront, those mean Toyo has read access to email and whatever SaaS stack is connected. Curious what the actual auth and permission scope looks like and whether that's scoped narrowly or broad by default.
Toyo
@ansari_adin fair question! Here's how it works:
Auth: Nothing is connected by default. You connect each tool individually via that provider's own OAuth consent screen (Composio is the managed auth layer — tokens live there, not in our DB). Disconnect any time; that revokes access.
Scope: Toyo never gets the raw API. It sees a curated allowlist of tools per integration, with hard server-side blocks on top: no deletes, and no send/reply/forward on Gmail or Outlook — Toyo cannot send email from your account, period.
Triage: reads mail, applies labels, and writes drafts to your drafts folder. It never sends.
Untrusted input: runs triggered by inbound email get less still — send-capable tools on any integration are withheld unless the message passes a prompt-injection screen. If the screen flags or fails, the run can only message you.
Lmk if you have any other questions!
@aidanhornsby The prompt injection screen on inbound email is the detail worth understanding better. What does "fails" look like in practice, is it a confidence threshold on a classifier, a specific pattern match, or something else? Curious because inbound email is exactly where a motivated attacker would try to manipulate Toyo's behavior, so the robustness of that screen is load-bearing for the whole security model.
Curious how you’re thinking about user-editable memory over time — for example VIPs, communication preferences, recurring priorities, and project context. Will users be able to inspect and adjust what Toyo “believes” about their work?
Toyo
@kryptonite_wei good question. The short answer is we are thinking a lot about this. We've been looking at all of the 'brain' solutions out there being released and adopted by individuals, and companies, and thinking deeply about the different needs of a solo-user 'second brain' type memory setup (md files in obsdian is pretty good!) and the rather different, far more complex requirements of a true 'company brain' shared across multiple agents in a work environment.
Today, you can simply ask Toyo for a summary of what it knows and understands about you and it will do a pretty good job of providing a summary (in my own testing the GPT-5.6 update we shipped after launch actually made this a little more exhaustive).
We're hoping to have something really fun to share on the topic of brains very soon — watch this space!
Love assistants that live inside imessage - have been a user of Poke!
Slightly unrelated question - what did you use to make the video?
Kilo Code
ping @aidanhornsby who made this awesome claymotion launch video
Toyo
@raghu_mohan1 Thank you so much! It was a lot of fun to make but all done with internal tools I built: Claude, Codex, Open AI image API, Replicate w/ Seedance 2.0, Grok Imagine & a lot of Final Cut Pro.
I'm gonna write up a bit more about the process soon!