PR typecheck
Copilot calls run_ci_privilege. Limetry allows ci_privilege so tests run. Deploy secrets stay unavailable.
Evaluate · outcomes · audit before irreversible tools run
Stop irreversible agent
side effects cold.
Evaluate before the tool runs. Outcomes: allow, deny, or wait for a human — then a scrubbed audit.
Evaluatein the agent loop
Denywith reasons + receipts
Auditscrubbed projections
Outcomesallow · deny · wait
evaluate.ts
import { createRemoteEngine } from "@limetry/sdk"
const engine = createRemoteEngine({
baseUrl: process.env.LIMETRY_BASE_URL,
apiKey: process.env.LIMETRY_BEARER_TOKEN,
})
const decision = await engine.evaluateAction({
intent_id: crypto.randomUUID(),
policy_id: policyId,
agent_id: "ci-bot",
action_type: "deploy",
resource: "github.com/acme/api@abc123",
issued_at: new Date().toISOString(),
})
if (!decision.ok || !decision.approved) {
throw new Error((decision.reasons ?? ["denied"]).join("; "))
}MIT-licensed MCP, CLI, and SDK. ActionIntent evaluate runs in TypeScript on the server. Audit stores scrubbed projections by default — see data minimization docs. Optional Rust FFI is spend-domain only, not the golden path.
Evaluate before the tool runs
ActionIntent hits the server first. Allowed types, resource patterns, cost caps, and approval gates — not a prompt instruction.
Outcomes you can enforce
Allow continues. Deny blocks with reasons and an HMAC receipt. Approval-required waits for a human. Your loop still enforces the outcome.
Scrubbed audit you can tail
Every evaluate writes a minimized projection. Operators see what policy did — not secrets, tokens, or chat transcripts.
How it works
Every tool call gets an outcome
Examples that prove the contract. The same evaluate path works for any irreversible tool — these loops show allow, deny, or wait in the wild.
Agent surface: Copilot coding agent
Fork production deploy
request_production_deploy on pull_request is untrusted. Limetry evaluates, records deny, then require_trusted fails closed before AWS keys load.
Main production deploy
Trusted push to main still returns approval_required. The coding agent prints approval_id and exits closed.
Same contract everywhere
Evaluate once. Enforce everywhere.
Evaluate before the tool runs.
Call createRemoteEngine().evaluateAction from any agent loop or adapter. Every evaluation returns an outcome — allow, deny, or wait — plus reasons and an HMAC receipt. The server requires intent_id (UUID) and issued_at.
Read SDK docsimport { createRemoteEngine } from "@limetry/sdk"
const engine = createRemoteEngine({
baseUrl: process.env.LIMETRY_BASE_URL,
apiKey: process.env.LIMETRY_BEARER_TOKEN,
})
const decision = await engine.evaluateAction({
intent_id: crypto.randomUUID(),
policy_id: policyId,
agent_id: "ci-bot",
action_type: "deploy",
resource: "github.com/acme/api@abc123",
issued_at: new Date().toISOString(),
})
if (!decision.ok || !decision.approved) {
throw new Error((decision.reasons ?? ["denied"]).join("; "))
}Examples that prove it
Where teams put Limetry in the path
These adapters prove evaluate in real agent loops. The stack stays the same when you add the next one.
GitHub Actions + Copilot
Allow · deny · approval
TypeScript
Shopify support / ops agent
Allow · deny · approval
TypeScript
Cursor / Claude SQL tool
Allow · deny · approval
TypeScript
OpenAI Procurement Agent
Recommended
TypeScript
Serverless Slack Cost Control
Integration
TypeScript
LangGraph Action Governance
Integration
Python
LangChain-style Governance
Simulation
Python
CrewAI-style Approvals
Simulation
Python
AutoGen-style Broker
Simulation
Python
ChatGPT GPT Actions Schema
Schema
YAML / JSON
Limetry Cloud
Same evaluate API. Org-grade control plane.
Run Limetry where your agents already work. Limetry Cloud adds multi-tenant policies, scoped agent tokens, plan-based audit retention, and an ops portal on the same evaluate API — when hosted signup is available for your team.