PR typecheck
Copilot calls run_ci_privilege. Limetry allows ci_privilege so tests run. Deploy secrets stay unavailable.
Evaluate · deny · audit before irreversible tools run
Stop irreversible agent
side effects cold.
Check the action before the tool runs. Outcomes: allow, deny, or wait for a human — then a privacy-safe audit trail.
Evaluatein the agent loop
Denywith reasons + receipts
Auditprivacy-safe records
Outcomesallow · deny · wait
evaluate.ts
import { createRemoteEngine } from "@limetry/sdk"
const engine = createRemoteEngine({
baseUrl: process.env.LIMETRY_BASE_URL,
apiKey: process.env.LIMETRY_BEARER_TOKEN,
})
const decision = await engine.evaluateAction({
intent_id: crypto.randomUUID(),
policy_id: policyId,
agent_id: "ci-bot",
action_type: "deploy",
resource: "github.com/acme/api@abc123",
issued_at: new Date().toISOString(),
})
if (!decision.ok || !decision.approved) {
throw new Error((decision.reasons ?? ["denied"]).join("; "))
}Open-source MCP, CLI, and Limetry SDK. Policy checks run on the self-hostable server. Audit stores privacy-safe records by default — see data minimization docs.
Check the action before it runs
Every proposed tool call hits your policy server first — allowed types, resource patterns, cost caps, and approval gates. Not a prompt instruction.
Outcomes you can enforce
Allow continues. Deny blocks with reasons and a signed receipt. Approval-required waits for a human. Your loop still enforces the outcome.
Audit trail you can tail
Every decision writes a privacy-safe audit record. Operators see what policy did — not secrets, tokens, or chat transcripts.
How it works
Every tool call gets an outcome
The same evaluate path works for any irreversible tool. These loops show allow, deny, or wait before the side effect runs.
Agent surface: Copilot coding agent
Fork production deploy
request_production_deploy on pull_request is untrusted. Limetry evaluates, records deny, then require_trusted fails closed before AWS keys load.
Main production deploy
Trusted push to main still returns approval_required. The coding agent prints approval_id and exits closed.
Same policy API everywhere
Check once. Enforce everywhere.
Evaluate before the tool runs.
Call createRemoteEngine().evaluateAction from any agent loop or adapter. Every evaluation returns an outcome — allow, deny, or wait — plus reasons and a signed receipt. The server requires intent_id (UUID) and issued_at.
Read SDK docsimport { createRemoteEngine } from "@limetry/sdk"
const engine = createRemoteEngine({
baseUrl: process.env.LIMETRY_BASE_URL,
apiKey: process.env.LIMETRY_BEARER_TOKEN,
})
const decision = await engine.evaluateAction({
intent_id: crypto.randomUUID(),
policy_id: policyId,
agent_id: "ci-bot",
action_type: "deploy",
resource: "github.com/acme/api@abc123",
issued_at: new Date().toISOString(),
})
if (!decision.ok || !decision.approved) {
throw new Error((decision.reasons ?? ["denied"]).join("; "))
}Examples
Where teams put Limetry in the path
Reference integrations for CI, Shopify, SQL, and common agent frameworks. Each uses the same evaluate API — add your own adapter when you need a new surface.
GitHub Actions + Copilot
Allow · deny · approval
TypeScript
Shopify support / ops agent
Allow · deny · approval
TypeScript
Cursor / Claude SQL tool
Allow · deny · approval
TypeScript
OpenAI Procurement Agent
Recommended
TypeScript
Serverless Slack Cost Control
Integration
TypeScript
LangGraph Action Governance
Integration
Python
LangChain-style Governance
Simulation
Python
CrewAI-style Approvals
Simulation
Python
AutoGen-style Renewal Broker
Simulation
Python
ChatGPT GPT Actions Schema
Schema
YAML / JSON
Open source
Install the stack. Run policy checks in your VPC.
Limetry SDK, CLI, MCP, and the evaluation server ship together. Apply an action policy, check every agent action from your loop, and tail the audit trail on infrastructure you control.