Every sweep on schedule.
Every run on the record.

Take a ready-made automation or write down your runbook in plain sentences. It triages reports, sweeps accounts and tracks every deadline, then opens the ticket or asks for approval. Every run is recorded, and changes wait for you.

Example instruction: When a phishing report lands, pull the original message and headers, check whether the gateway delivered it, and post a verdict of phish, credential harvest or benign with the evidence. ## Verdicts | Signal | Verdict | |---|---| | Link to a login page | Credential harvest | | Known sender, odd reply-to | Suspicious | | Internal newsletter | Benign | - Never block or purge — post the verdict for an analyst.

In your own words.
Built for real work.

One sentence is enough to begin. The same document grows into a full procedure when the job needs it.

  • Plain language

    Write it the way you would brief a colleague. No flowcharts, no code.

  • Rules, tables and exceptions

    Add limits, scoring tables and edge cases as they come up, right in the same document.

  • Judgment, not just steps

    Say what good looks like and when to ask you. It follows the intent, not a rigid path.

Browse advanced workflows

Your files. Your tools.
No new system.

AUTOMATE.md is just another file in your folder. Nothing to migrate, nothing to replace.

  • Starts on its own

    A new email, a schedule, a changed folder or an edited file starts it. No one has to remember.

  • Your apps, connected

    Email, calendars, drives and team apps. Connect only what the job needs.

  • Next to the work

    It sits beside the invoices, CVs and sheets it works on, and reads them like you would.

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

Ready-made for IT and security teams. Pick one and run it.

Each one is a plain-language document. Use it as it is, or change the timing, the rules and the tools to match your team.

Phishing Report Verdict

When a phishing report lands, pull the original message and headers, check whether the gateway delivered it, and post a verdict of phish, credential harvest or benign with the evidence.

When an employee reports a suspicious email

Stale Account Sweep

Every Monday at 7am, list accounts with no sign-in for 45 days, then record the owner and last activity for the access queue.

Every Monday at 7:00am

Critical CVE Triage

When a critical CVE is published, check the asset list for the affected product, open one ticket per owner, and post the host count and the patch deadline.

When a critical CVE is published for a product in the asset list

Privileged Login Review

Every Friday at 4pm, pull the week's admin sign-ins, flag any from a country or address not seen before, and post the short list for review.

Every Friday at 4:00pm

Patch Compliance Report

Every weekday at 7:30am, list the devices past the patch window with the days overdue, and assign each one to the owning team with a restart date.

Every weekday at 7:30am

File Restore Test

On the 15th, restore one file from the newest backup, check that it opens, and log the result against the recovery objective for that server.

On the 15th of each month

Every stage of the work. Every recurring job.

The recurring work IT and security teams do every week, grouped the way it happens.

  1. 01

    Harden

    Access, joiners and leavers, and patching. It breaks when an account survives a leaver or a host misses its window.

  2. 02

    Triage

    Alerts, reports and findings. It breaks when the first decision waits until someone reads the queue.

  3. 03

    Prove

    Reviews, restores and evidence. It breaks when a green job status stands in for a tested recovery.

Compared with what you use today.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Around the tools you already run.

Connect only what a job needs. Your inbox, calendar, files and the systems below stay where they are, with nothing to migrate.

Everyday
GmailOutlookGoogle CalendarSlackMicrosoft TeamsGoogle DriveGoogle SheetsExcel
SIEM
Microsoft SentinelSplunkElastic Security
XDR
Microsoft Defender XDR
Log management
Graylog
EDR
CrowdStrike Falcon
SOAR
Splunk SOARTheHive
On-call
PagerDuty
Identity
Microsoft Entra IDOkta
PAM
CyberArk
Email security
Microsoft Defender for Office 365ProofpointAbnormal Security
Vulnerability
QualysTenable.ioRapid7 InsightVM
Cloud security
WizOrca Security
Secrets
HashiCorp Vault
Endpoint
JamfMicrosoft Intune
ITSM
ServiceNow Security OperationsJira Service Management
GRC
Vanta
Backup
VeeamCohesity
Training
KnowBe4
Chat
Slack

What IT and security teams ask before handing anything over.

What exactly can it access?
Only what you connect for each automation, and each one gets its own scope. Changes you mark as needing approval wait for a person.
Is every action recorded?
Yes. Every run keeps what it read, what it did and what it is waiting on, and the instructions themselves are a reviewable document.
Can we choose the model, or keep it local?
Yes. Choose a cloud provider or run a local model, per automation. Switching models does not mean rewriting the instructions.
Is this another agent with admin rights?
No. It is many small automations, each with its own lane and limits, instead of one agent with sweeping access. A failure stays contained to its job.
Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon