limetry/limetry

Limetry is open-source agent action governance. Before an irreversible tool
runs, your agent submits an action intent. The server checks it against your
action policy and returns allow, deny, or approval_required with reasons
and a signed outcome receipt. Audit storage keeps a privacy-safe record you
can tail from the CLI or MCP.
Open source (MIT license). Run your own node from this repository. Enforce
outcomes in the agent loop or resource middleware — Limetry is advisory until you do.
The product is the evaluate stack (SDK, CLI, MCP, server). Optional adapters
extend it for CI, SQL, Shopify, and other surfaces you wire into agent loops.
Example adapters (install only what you need):
| Package | Role |
| @limetry/ci | GitHub Action + helpers for privilege / release gating (repo@sha) |
| @limetry/sql | Postgres/Supabase MCP write gate that owns DATABASE_URL |
| @limetry/shopify | Admin API mutation firewall that holds the Admin token |
Shared core: @limetry/sdk, @limetry/server, @limetry/cli, @limetry/mcp.
> [!WARNING]
> Agents can bypass Limetry unless your middleware or downstream resource
> rejects actions without a verified evaluation or approval. Outcomes are
> advisory by default. Call evaluateAction (SDK), limetry eval (CLI), or
> limetry_evaluate (MCP) and enforce the decision in your loop. Read
> SECURITY.md.
> [!NOTE]
> Policy matching uses the full intent. Audit stores a privacy-safe record
> (audit_mode=minimal by default). Do not put secrets or chat transcripts in
> metadata / details.
## What evaluate covers
| Input | Limetry response |
| Irreversible tool call | Policy check before execute |
| High-risk action | approval_required + payload-hash-bound approve |
| Failed action with no trail | Privacy-safe policy.evaluated / action.recorded audit |
| Policy living only in prompts | Server-authoritative action policy over HTTP |
| IDE-native operators | MCP + CLI against a self-hosted node |
## How it works
text
Agent / SDK / MCP / adapter ──→ action intent
Policy evaluation (HTTP server)
allow · deny · approval_required · receipt
Privacy-safe audit (+ pending approvals store)
▼ (enforce in adapter / middleware)
Tool execution
1. Intent — propose an action (type, resource, optional cost).
2. Evaluate — action policy rules: types, resource patterns, cost caps, approval knobs.
3. Outcome — allow, deny, or approval_required (durable pending row + payload hash).
4. Audit — privacy-safe events; tail via CLI or MCP.
5. Approve — reviewer resolves pending approvals; adapters resume only after hash match.
## What's in this repository
| Component | Path | Role |
| Governance server | packages/server | Policy checks, approvals, privacy-safe audit, policies |
| TypeScript SDK | packages/sdk | Limetry SDK, redact helpers, slim policies |
| CLI | packages/cli | setup, policy apply, eval, approvals, audit tail |
| MCP server | packages/mcp | MCP tools for Cursor / Claude Desktop |
| CI adapter | packages/ci | @limetry/ci GitHub Action + library |
| SQL adapter | packages/sql | @limetry/sql Postgres/Supabase write gate |
| Shopify adapter | packages/shopify | @limetry/shopify Admin mutation firewall |
| Website + docs | packages/web | limetry.com marketing site and documentation |