creatorrmode-lead/avp-sdk

**The risk isn't what AI says. It's what AI does.**
AgentVeil is an independent action-control layer for AI agents and MCP tools.
It works alongside agent runtimes such as Cursor, Claude Code, Codex, Gemini
CLI, and Hermes CLI: attempt, decision, controlled path when available, local
proof.
Quick Start · Console · The Loop · Connectors · Evidence · Scope · Design Basis · Docs
**Packages**: agentveil-mcp-proxy · agentveil | **Website**: agentveil.dev | **Console**: agentveil.dev/console | **Package source**: packages/agentveil-mcp-proxy/
> **Agent action boundary:** AI runtimes execute agents. AgentVeil mediates
> configured action paths around them. When a native or risky action hits the
> boundary, AgentVeil decides allow, approval required, redirect guidance toward
> a controlled path, or hard-block. Routed MCP calls follow the same decision
> model and record bounded local evidence.
>
> AgentVeil is not machine-wide control. Actions outside configured AgentVeil boundaries are not classified or logged.
> **Visual overview:** request → AgentVeil boundary → redirect / approval / hard-block → local proof.
>
> **Data handling:** AgentVeil is designed to keep raw MCP arguments local by default and to record bounded metadata and hashes for evidence. See Data Handling.
The AgentVeil Loop
AgentVeil is one product loop, not a pile of separate components:
| Step | What happens |
|---|---|
| Attempt | Agent tries a native mutation or routed MCP action in a configured project |
| Decision | AgentVeil returns allow, approval required, redirect, or hard-block |
| Controlled path | When one is available, redirect guidance tells the agent to retry through the managed MCP route |
| Proof | Bounded local evidence records the decision; inspect it with events show --last |
Approval fixes actions that need human review. Redirect tells the agent to
retry through the controlled MCP route when one is available. Hard-block means
approval will not help for that action. Local proof is available now through
the CLI—not a future dashboard page.
What AgentVeil Adds
AgentVeil is not an AI agent and does not replace an agent runtime. It adds a
control layer around actions that are configured to pass through AgentVeil.
| Layer | Agent runtime / framework | AgentVeil adds |
|---|---|---|
| Execution | Runs the agent and exposes tools | Mediates configured action paths before execution |
| Approval | May prompt per tool call, depending on runtime | Adds policy-aware approval for routed writes and mutations |
| Risk classification | Runtime-specific, if present | Shared read / write / destructive / unknown classification |
| Sandbox boundary | Runtime-specific | Project or downstream sandbox limits for routed actions |
| Evidence | Usually chat or runtime logs | Bounded local records with request ids, decisions, and hashes |
| Cross-runtime consistency | Per runtime | Same core control semantics where actions are routed through AgentVeil |
Quick Start
Use AgentVeil with a supported project connector, or run the Core MCP Proxy directly.
Start from the Console
Sign in at agentveil.dev/console/auth
with GitHub or Google, pick your agent, and run the command the Console shows.
The same commands are listed below for each connector.
When you run a connector's setup command, AgentVeil opens the Console in your
browser so you can approve this machine. The Console then shows what your
connected projects report: project connection status, decision summaries and
approval summaries. Raw prompts, source code and file contents stay on your
machine. Local protection works without the Console.
If the browser did not open (for example on a headless machine) or you closed
it, connect later:
login prints a verification URL and a short code (--no-open for headless
use); agentveil-mcp-proxy logout disconnects this machine. See
Connect To AgentVeil Console
for the exact scope.
Cursor project connector
Choose the project folder you want to protect, then reopen / reload Cursor for that project.
After setup, in the configured project:
- supported native risky agent actions can be blocked before execution;
- the agent receives redirect guidance toward the AgentVeil MCP route;
- routed MCP writes can require approval;