u/Hussam3bd

For the past few weeks I've been building a package around one idea: an operation should be written once.

You write it as an Action class. The same class then answers a web route (JSON and forms, with Precognition), an Artisan command, a queued job, a typed TypeScript function, a laravel/ai agent (a copilot in your app), and MCP clients like Claude.

#[Expose]
final class CreatePost extends Action
{
    protected ?Effect $effect = Effect::Write;
    public function schema(JsonSchema $schema): array { /* … */ }
    public function authorize(ActionContext $context): bool { /* … */ }
    public function handle(ActionContext $context, ValidatedInput $input): array { /* … */ }
}

Every caller goes through the same pipeline: exposure, token abilities, tenant membership, `authorize()`, validation, `handle()`, and an allowlist on the output. So the AI can't do anything your form wouldn't allow, and you don't keep a separate pile of agent-only tools that drift from your real validation.

The idea comes from Agent-Native by Builder.io, where one `defineAction()` serves the UI, the agent, HTTP, MCP and the CLI. This brings that to Laravel, built on laravel/ai and laravel/mcp.

It's in beta (0.9), MIT licensed, and the API can still change before 1.0.

• Docs: https://agentic-actions.com
• Demo (private 24-hour sandbox, no sign-up): https://demo.agentic-actions.com
• Code: https://github.com/agentic-actions/laravel

I'd really like feedback: what breaks, what's missing, and whether this fits how you build Laravel apps.

Kind of a dumb origin story but here it is. A few months back someone got into one of our systems and used it to send spam. They had a big list of Outlook addresses they'd bought somewhere and blasted some insurance offer to all of them. Half those addresses didn't even exist, so they bounced all at once, from our domain.

That was enough. AWS suspended us, Outlook started blocking our domain, and then our actual emails to real customers (password resets, invoices, the boring important stuff) just stopped landing. Took weeks to crawl back.

The annoying part is every one of those dead addresses could've been caught before we hit send. So I built a thing to validate emails first, ran it on our own systems for a while, and now it's public.

It's called BounceShift. Checks format, MX, SMTP, disposable/catch-all/role accounts, gives you a status + a confidence score. API + SDKs for PHP/Laravel/Node. Emails get stored as hashes so we can't read them.

100 free a month. Mostly just want to know if the accuracy holds up on your lists. Roast it.

https://bounceshift.com