Open-source agent action governance

Updated July 2026 — framing is evaluate → deny → audit. Optional cost fields on ActionIntent cover spend-shaped actions.

Limetry is open-source evaluate → deny → audit for agent tool calls: MCP, CLI, SDK, and a self-run evaluation server.

Agents browse, purchase, deploy, delete, and call external APIs. Irreversible side effects cannot be undone from a prompt. Evaluate policy before the tool runs. Limetry returns allow/deny with reasons and writes a privacy-safe audit trail (audit_mode=minimal by default).

Payments are one optional policy domain (amount / merchant fields), not a custody layer.

Check an action intent

POST evaluate of an ActionIntent against an ActionPolicy. Signed outcome receipts let middleware detect tampering.

import { RemotePolicyEngine, createSlimActionPolicy } from "@limetry/sdk"

const engine = new RemotePolicyEngine({
  apiKey: process.env.LIMETRY_BEARER_TOKEN!,
  baseUrl: "http://localhost:3810",
})
const policy = createSlimActionPolicy({
  allowedTypes: ["http_post", "deploy"],
  auditMode: "minimal",
})
const decision = await engine.evaluateAction(intent, policy)

What evaluate provides

1. Server-authoritative action policy: Types, resource patterns, optional cost caps — evaluate over HTTP from MCP, CLI, or SDK.
2. Decision integrity: Signed outcome receipts bind allow/deny so middleware can detect tampering.
3. Privacy-safe audit: Evaluate uses full intent; storage keeps a minimized projection. Do not put secrets in metadata/details.

Self-host Limetry

Limetry (open source) includes the SDK, self-run evaluation server, CLI, and MCP package. You operate the node and retention.

Start with the GitHub repository or the quick start. For production ops, see [self-run setup](/docs/server/self-run setup).