intutic/intutic

**The circuit breaker for AI agents: your policies are files in git, enforced synchronously at the tool call, across 43 agent harnesses.**
Quickstart • Architecture • Key Features • Supported Harnesses • Docs
---
💡 Why Intutic?
Observability tools and LLM gateways (like LangSmith or Portkey) work on model traffic: they trace each call, and their gateways and guardrails can cap spend, redact or reject a request inline. What they do not control is the agent's local tool execution — the shell command that deletes files, the write that leaks a secret, the loop that keeps calling an API. A gateway can stop an MCP call only when the call is routed through its own MCP gateway, as Portkey's now can.
**Intutic is an active circuit breaker at the tool call.** In 36 of the 43 supported harnesses, each tool call passes through a policy gate before it runs — a rule decision, not a model call — that blocks dangerous commands and steers agentic loops in real time. The proxies cover the rest, and the model traffic as well.
---
🏗️ Architecture
Intutic runs as a local or self-hosted proxy, written in Rust, between your agents and their model providers. With intutic connect, a sync daemon (sync-daemon) also installs a tool-call gate in each harness that supports one and keeps its rules files in sync:
---
⚡ 30-Second Quickstart
1. Install the CLI & Native Proxy Gateway
2. Start the Proxy
Run intutic start inside your project folder. This boots the local high-speed Rust proxy on port 4000 — no account, configuration file or control plane needed:
3. Route Any Agent to Intutic
Point your favorite LLM client or agent framework to the local proxy:
That's it! Your agent is now governed by real-time safety guardrails.
---
🔥 Key Features
| Feature | Description |
| :--- | :--- |
| ⚡ **In-Process WASM Engine** | Policy evaluation runs in-process — no model call and no network hop — so it adds no round-trip to the tool-call path. |
| 🛡️ **Zero-Trust Tool Interception** | Intercepts dangerous commands before they touch your system: rm -rf and git push --force are blocked at the harness hook gate; a DROP TABLE in an MCP tool call is blocked by the MCP governance proxy, at the hook gate it is flagged for triage rather than blocked, and the LLM proxy refuses one in a model-emitted shell command (psql, mysql, sqlite3, dropdb) whose target database is not on the workspace's DSN allowlist — opt-in, via sql_guard: in a SOP. |
| 🔐 **Secret DLP & Masking** | Automatically redacts API keys ([REDACTED_SECRET]), AWS credentials, and tokens in prompts & tool payloads. |
| 💰 **Session Spend Ceilings** | Prevents "loop burn" by enforcing token spending ceilings per session (e.g. $5.00 limit). |
| 🔄 **43 Harness Adapters** | Pre-configured support for Claude Code CLI, Cursor, Windsurf, Aider, Antigravity, OpenCode, DeepSeek dsh, Spotify Xirp, DoorDash Agentic Orchestrator, AWS Bedrock AgentCore Runtime, and more. |
| 🤖 **Single & Multi-Agent Swarms** | Governs single developer tools as well as multi-agent graph/swarm workflows — LangGraph, LangChain, CrewAI, AutoGen, AG2, Google ADK, OpenAI Agents SDK, Pydantic AI, smolagents, AWS Strands Agents, and Microsoft Agent Framework each have a dedicated SDK-side gate (Python); Mastra, the Vercel AI SDK, eve, AI SDK Harness, AI SDK Workflow, and TrueForge (embedded) have the same on the TypeScript side (@intutic/gate). |
---
🛡️ The 5 PCAS Primitives
Every tool call and prompt evaluated by Intutic produces one of five **PCAS Action Primitives**:
1. **BYPASS**: Standard safe execution passes through natively (in-process, no added network hop).
2. **ENHANCE**: Inject contextual SOP prompt rules or architectural guidelines.