Introduction

Check agent action intents against your policy on a self-run Limetry evaluation server.

Before an irreversible tool runs, submit an action intent (tool call, HTTP write, deploy, spend request). The evaluation server matches it against your action policy and returns allow, deny, or approval_required with reasons and a signed outcome receipt. Audit storage keeps a privacy-safe record, not the raw intent bag.

Enforce the outcome in your agent loop or resource middleware. Outcomes are advisory until you do. Agents can bypass Limetry if you skip that check.

Gate irreversible tool calls

Draft an intent — type, resource, optional cost.
Evaluate — action policy rules: allowed/denied types, resource patterns, cost caps, approval knobs.
Read the receipt — allow, deny, or approval_required with reasons.
Enforce — skip or execute the tool; record executed / skipped / blocked.
Audit — tail privacy-safe policy.evaluated and action.recorded events.

Call evaluate from the Limetry SDK, CLI (limetry eval), or MCP (limetry_evaluate).

Read the architecture

Agent (LLM + tools / MCP host)
        │
        ▼ action intent (full intent for matching)
┌───────────────────────┐
│  Limetry server       │  ← self-run evaluation API
│  Policy evaluation    │  ← TypeScript on the server (HTTP)
│  Privacy-safe audit     │  ← minimal record by default
└───────────────────────┘
        │
        ▼ (optional) enforce in your middleware
  Tool execution

Policy matching uses the full intent. Audit stores a privacy-safe record. See Minimize audit data.

Components in this repository

Open source (MIT license):

packages/server — evaluation server (policy checks + audit)
packages/sdk — TypeScript SDK (@limetry/sdk)
packages/ci — GitHub Actions CI/CD privilege gate (@limetry/ci)
packages/shopify — Shopify mutation firewall (@limetry/shopify)
packages/sql — SQL write gate MCP server (@limetry/sql)
packages/cli — CLI tools (@limetry/cli)
packages/mcp — MCP server (@limetry/mcp)
examples/ — Integration walkthroughs

Property	Value
Primary API	`/v1/policy/evaluate`, `/v1/actions/record`, `/v1/audit`
Audit storage	Privacy-safe record; `audit_mode` minimal (default) or forensics
Enforcement	Opt-in in your agent, CI workflow, or resource middleware
License	MIT

Continue

Evaluate your first intent

Start the evaluation server, apply a policy, and deny a prod POST.

Call the SDK

Action intents, the Limetry SDK, and typed errors.

Connect an MCP host

Cursor, Claude Desktop, and other MCP hosts.

Self-run the server

Environment, containers, and production wiring.

Optional platform integrations:

Gate GitHub Actions

Evaluate ci_privilege and deploy before secrets load.

Gate Shopify mutations

Hold Admin tokens and evaluate refunds before Shopify sees them.

Gate SQL writes

Own DATABASE_URL and classify statements over MCP.