Frequently asked questions

Can an AI agent do anything a person cannot?

No. An agent connects with a person's API key (or a service account's) and acts with exactly those permissions, through the same services as the web app. Everything it does is recorded under that person and marked as done by an agent. See Working with AI agents.

Can an agent see projects it should not?

No. A project the key's owner cannot see does not exist for the agent either: it is not listed, and asking for it answers "not found". A read-only key cannot write at all; the database refuses it.

Which agents and tools work with Quasar?

• Any client that speaks MCP over HTTP with a bearer token. The in-app Help Center gives the exact setup for Claude Code, Codex, opencode and pi.
• Any program through the REST API.
• ChatGPT and other assistants can read a published guide, like this one, through its public MCP server or its OpenAPI description, with no key.

Does Quasar write to my git repository?

No. It reads branches, commits, tags and pipeline results to show where each issue's code is. It never commits, merges, branches or tags. The one thing it creates is the webhook that tells it about new commits. For version branches and releases it proposes the exact git commands and checks afterwards that they happened.

Which git hosts are supported?

GitHub, GitLab and Bitbucket Cloud, one repository per project.

Can we run Quasar on our own infrastructure?

Yes. The same product runs self-hosted, by default with a single organization. It needs:

• the application and its rendering worker (one container image);
• PostgreSQL;
• file storage (a volume or S3-compatible);
• optionally, ClamAV and an SMTP or Amazon SES mail service.

See Deployment, tenancy and security.

How is our data kept apart from other organizations'?

By PostgreSQL row-level security, enforced on every table that holds an organization's data. The application connects with a role that cannot bypass it, and the isolation is tested against a real database in every release.

Can we sign in with our own identity provider?

Yes, any OpenID Connect provider, chosen per installation. Quasar can also manage its own accounts, with a password and a second factor.

Is two-factor authentication supported?

Yes:

• Methods: an authenticator app or a security key; SMS is not offered.
• Policy: an organization can require it of everyone.
• Step-up: sensitive actions ask for a fresh second factor.

Is there a mobile app?

No. The web interface is designed for desktop screens, 1,024 pixels wide and more.

Which languages are supported?

The interface is in English today. It was designed to be translated, and the next languages on the roadmap are Italian and French, followed by other European languages. Documents can be written in any language, each with its own content language. Built-in document templates are available in English and Italian.

Where is the hosted service's data?

In the European Union: the hosted service runs on Amazon Web Services in Ireland. A self-hosted installation keeps its data wherever you run it.

Can we publish documentation publicly?

Yes. An organization administrator can make a published documentation release readable by anyone at its own address, without an account, three ways:

• web pages, with search and a site map;
• a REST API, with an OpenAPI description;
• an MCP server that AI assistants can connect to.

What is public is only what was accepted and published, and pausing it takes it offline at once.

What happens to the time an agent spends?

Quasar measures it: the agent opens a work session when it starts a turn and closes it when it hands back, and Quasar's own clock stamps both. A session becomes a work log, with its cost, only when a person confirms it.

Can an agent approve its own work?

Two things stand in the way.

• The contract. Quasar's agent contract tells every agent to accept a document or a release revision only on a person's explicit word. Every acceptance is recorded with whose key made it, and whether an agent acted.
• The workflow. It can require conditions an agent cannot fake:
  • a verified plan;
  • the code having actually reached a branch;
  • time logged.

To keep a key from accepting at all, give the agent a key whose owner is not a project lead, or a read-only key.

Does Quasar send email?

Only for deadline reminders and password resets, through SMTP or Amazon SES. There are no email digests and no outbound webhooks.

Is there AI inside Quasar?

Quasar does not run a model of its own. It is built so that your agents, whichever you choose, can work in it safely. Search is full-text, not semantic; where meaning matters, an agent reads document summaries and chooses.

Can we export our data or leave?

• Every person can export their own data as JSON at any time.
• A whole organization can be exported in full, then deleted after a grace period.
• Documents and releases export to PDF, Word, HTML and Markdown.

How do we know which version we are running?

Versions are numbered by date (YYYY.MM.N). The running version and its commit are shown in the application and available from the API.