The execution safety layer for AI agents.
The last check before an AI agent does something it can't undo. Autonomy belongs to the action, not the agent. A consequential action happens at most once, exactly as approved, and leaves a receipt — and when the outcome is unknown, CTRLRun says so instead of guessing.
A Python library that sits between the decision to act and the call that acts. Runs in production on a single file, or on Postgres across hosts. Apache-2.0.
A refund is the example, not the scope. The same boundary goes in front of a deployment, a deletion, an IAM grant, a message that leaves the building — any action an agent takes that the world remembers. Nine domains, and how it transfers.
An agent refunds €500. The call reaches the provider and commits. The reply is lost on the way back, so the agent sees an error — and does what every retrying client does. The customer is refunded twice, and nothing in the stack noticed.
The bug is not the retry. It is that the agent had no way to tell this failed from I do not know what happened. Retry libraries, agent frameworks and tool loops collapse those two into one, and a write that may already have committed is retried as though it certainly had not.
CTRLRun does not collapse them. A lost reply is AMBIGUOUS, never FAILED, and a retry against an AMBIGUOUS effect is refused — until a human, or a reconcile hook, says what happened.
No Python to hand? Break a protected action in your browser: one refund under one policy on the released wheel, in the tab, with nothing sent anywhere. Approve €2,000, execute €5,000, lose a reply, retry — and read what refused yo
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/CTRLRun--ctrlrun.html)
Stateless governance proxy for MCP (2026-07-28): policy, dry-run, human confirmation, audit, tracing
batrapulkit/squidbrakeBrakes for your AI agents: every tool call is checked against your rules, held for human approval when risky, and recorded in a tamper-evident audit trail. Works with Claude Code and any MCP app.
lindixu6-hash/awesome-agentic-engineeringExecutable AI agent readiness gate: GitHub Action, prompt injection evals, LangGraph traces, risk profiles, and bilingual EN/中文 docs.
Smitner-Studio/facetRender agent-written Markdown as a live local page, and send the human's click back to the agent as typed data. Human-in-the-loop approval gates for coding agents.
graygnatconsole/mcp-audit-tool🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI
PyModel/jev-judge-mcpTyped judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, o
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.