Limitrum

Limitrum

Policy kernel for autonomous AI agents.

Official site: limitrum.com

Verify sensitive AI actions before they touch money, data, infrastructure, or external APIs.

Website | Release | npm

---

What Limitrum Is

Agents are starting to execute real actions: charge customers, call APIs, mutate data, open tickets, run tools, and trigger workflows.

I am building Limitrum around a simple belief: autonomous agents should not be trusted only because a prompt says they will behave. Before an agent touches money, data, infrastructure, or an external API, there should be a deterministic policy layer outside the model.

Limitrum gives agents that hard runtime boundary:

flowchart LR
  Agent["AI Agent"] --> Intent["Normalized Intent"]
  Intent --> Kernel["Limitrum Policy Kernel"]
  Kernel -->|ALLOW| Tool["Tool / API / Workflow"]
  Kernel -->|BLOCK| Audit["Reasoned Audit Event"]

In product terms:

AI agent -> Limitrum -> tool/API/database/shell

The model can propose an action. Limitrum decides whether that action is allowed to execute.

This open-source repo includes the local policy kernel, SDK adapters, CLI, MCP server, and examples needed to evaluate actions deterministically. The goal is to make the core security primitive easy to inspect, test, and extend before teams decide to run it in production.

Open-Core Boundary

This repository is the open-source core.

Included here:

• TypeScript policy kernel and SDK
• Local SQLite-backed policy and audit store
• CLI simulator
• MCP server for local tool enforcement
• Local HTTP verification gateway compatible with LIMITRUM_API_URL
• OpenAI, Anthropic, Gemini, Mistral, LangChain, and OpenAI-compatible provider adapters
• Protected MCP tools for Claude/Cursor-style workflows
• Zero-cost local examples and tests
• Public marketing website

Not included here:

• Managed multi-tenant Limitrum Cloud API
• Multi-tenant dashboard
• hosted API-key lifecycle
• team workspaces, RBAC, SSO, SCIM
• long-term audit retention
• SIEM export
• VPC / on-prem enterprise deployments
• billing, usage metering, and support tooling

See [docs/COMMERCIALBOUNDARY.md](docs/COMMERCIALBOUNDARY.md) for the product boundary.

Why Developers Use It

• Deterministic enforcement: explicit rules return clear allow/block verdicts.
• Runtime budgets: cap daily spend, per-action cost, and request rate.
• Tool boundary: block dangerous actions such as unknown domains, process spawn, destructive mutations, and data exfiltration.
• Policy rules: developers define ordered allow, deny, and require_approval rules in limitrum.policy.yml.
• Signed agent identity: require Ed25519-signed intents from trusted agent keys when the workflow needs stronger identity separation.
• Policy QA: lint policies and run scenario files before shipping a changed boundary.
• Tamper-evident audit: every decision can be logged locally with the reason, guard, policyHash, intentHash, auditHash, and auditChainHash.
• Agent-native: wraps OpenAI, Anthropic, Gemini, Mistral, LangChain, DeepSeek/Kimi/Grok-style OpenAI-compatible calls, MCP, and custom tool calls.
• Drop-in tool firewall: guardTool() protects app-owned functions before they touch Stripe, GitHub, shell, databases, or internal APIs.

Current Status

Limitrum is an alpha developer release. It is usable today as a local policy kernel, CLI, SDK adapter layer, MCP server, and HTTP verification gateway. The hosted cloud product is intentionally not part of this public repo yet; this repository is the foundation and proof of the policy-kernel model.

The fastest way to verify that the runtime boundary works end to end:

corepack enable
pnpm install
pnpm validate:runtime

If pnpm is not available, run corepack enable once or prefix the commands with npx pnpm.

What To Use First

npm install -g @limitrum/cli @limitrum/mcp-server
limitrum init
limitrum bots
limitrum policy explain agent_local
limitrum policy allow api.sendgrid.com
limitrum policy block "rm\\s+-rf"
limitrum policy approval api.stripe.com --amount-gte 500
limitrum identity generate --trust --require
limitrum policy lint
limitrum protect --action fetch --target api.github.com --amount 1 -- node -e "console.log('allowed')"
limitrum verify --action fetch --target api.github.com --identity-key .limitrum/agent_local.ed25519.private.pem --json
limitrum protect --action fetch --target api.unknown-exfil.io --amount 1 -- node -e "console.log('blocked')"
limitrum verify --agent-id agent_local --action stripe.charge --target api.stripe.com --amount 800 --approved-by owner@example.com --approval-id approval_123 --json
limitrum logs verify agent_local
limitrum doctor

For the real install-and-use path, see [docs/GETTINGSTARTED.md](docs/GETTINGSTARTED.md). For dynamic bot policies and allow/block rules, see [docs/POLICYMODEL.md](docs/POLICYMODEL.md). For self-hosted cloud/API deployment, see [docs/DEPLOYGATEWAY.md](docs/DEPLOYGATEWAY.md). For the shortest integration path, see [docs/INTEGRATEIN5MINUTES.md](docs/INTEGRATEIN5MINUTES.md). For Claude/Cursor/MCP and provider-specific setup, see [docs/USEWITHAGENTSTACK.md](docs/USEWITHAGENTSTACK.md). For product-level examples, see [docs/USECASES.md](docs/USECASES.md). For the new tool-call firewall path, see [docs/AGENTTOOLFIREWALL.md](docs/AGENTTOOLFIREWALL.md). For the HTTP gateway path, see [docs/HOSTEDGATEWAY.md](docs/HOSTEDGATEWAY.md). For the governance architecture, see [docs/GOVERNANCEARCHITECTURE.md](docs/GOVERNANCEARCHITECTURE.md).

Quickstart

Option A: Install from npm

For an app that wants to integrate the SDK directly:

npm install @limitrum/sdk @limitrum/db

For the CLI:

npm install -g @limitrum/cli
limitrum init
limitrum protect --action fetch --target api.github.com --amount 1 -- node -e "console.log('allowed')"

The standalone CLI bootstraps its local tables automatically in ~/.limitrum/limitrum.sqlite. limitrum init creates a local agent, a policy, limitrum.config.json, and limitrum.policy.yml for the current project. Developers can then change allow/block/approval rules with limitrum policy allow, limitrum policy block, limitrum policy approval, or by editing limitrum.policy.yml and running limitrum policy sync.

To connect Claude Desktop, Cursor, or another MCP client:

npm install -g @limitrum/mcp-server
limitrum init

Then add the MCP config printed by limitrum init to your client. Claude/Cursor can then call limitrum_guard and the protected tools exposed by @limitrum/mcp-server.

Published packages:

• @limitrum/sdk
• @limitrum/db
• @limitrum/cli
• @limitrum/mcp-server

Option B: Run the repo locally

1. Install

git clone https://github.com/Jayden-Siete/Limitrum.git
cd Limitrum
corepack enable
pnpm install

2. Prepare the local policy database

pnpm db:migrate
pnpm db:seed

3. Run a local simulation

pnpm --filter @limitrum/cli dev simulate

The simulation creates a demo agent and runs repeated tool intents through the policy kernel without spending money on model calls.

4. Verify real allow/block behavior

Allowed target:

pnpm --filter @limitrum/cli dev verify \
  --agent-id agent_local \
  --action openai.chat.completions.create \
  --target api.openai.com/v1/chat/completions \
  --amount 1

Blocked exfiltration target:

pnpm --filter @limitrum/cli dev verify \
  --agent-id agent_local \
  --action fetch \
  --target api.unknown-exfil.io \
  --amount 1

Machine-readable verdicts:

pnpm --filter @limitrum/cli dev verify \
  --agent-id agent_local \
  --action fetch \
  --target api.unknown-exfil.io \
  --amount 1 \
  --json

Use --fail-on-block when you want blocked verdicts to fail a CI step.

One-command runtime validation:

pnpm validate:runtime

SDK Example

import { LimitrumGuard, guardTool } from "@limitrum/sdk";

const guard = new LimitrumGuard();

const chargeCustomer = guardTool(guard, {
  agentId: "billing-agent",
  toolName: "stripe.createCharge",
  target: "api.stripe.com/v1/charges",
  amount: ({ input }) => input.amount,
  execute: async (input) => {
    // Real Stripe call goes here. It only runs after Limitrum returns ALLOW.
    return {
      chargeId: "ch_mocked",
      customerId: input.customerId,
      amount: input.amount,
    };
  },
});

const result = await chargeCustomer({
  customerId: "cus_123",
  amount: 50,
});

if (!result.executed) {
  throw new Error(`Blocked by ${result.verdict.guardTriggered}: ${result.verdict.reason}`);
}

Repository Layout

apps/
  cli/                 Local CLI simulator and policy tools
  mcp-server/          MCP tool server for local agent enforcement
  web/                 Public Limitrum website
  examples/
    agent-tool-firewall/
    provider-matrix/    OpenAI, Claude, Mistral, Gemini, DeepSeek, Kimi, Grok
    unsafe-agent-simulation/        Zero-cost OpenAI adapter simulation
    mcp-agent/         Zero-cost MCP client simulation
    protected-tool-call/
    mistral-tool-call/
packages/
  db/                  SQLite schema, migrations, seed data
  sdk/                 Policy kernel, guards, adapters
tests/
  unit/                SDK and adapter tests
docs/
  ARCHITECTURE.md      Runtime model and guard flow
  COMMERCIAL_BOUNDARY.md
  AGENT_TOOL_FIREWALL.md
  HOSTED_GATEWAY.md
  ARCHITECTURE_AND_VALIDATION.md
  INTEGRATE_IN_5_MINUTES.md

MCP Server

Run Limitrum as an MCP tool server:

pnpm --filter @limitrum/mcp-server dev

Available tool:

• limitrum_guard: verifies an intent and returns an allow/block verdict.
• limitrum_http_fetch: protected HTTP fetch.
• limitrum_shell_exec: protected shell command.
• limitrum_github_create_issue: protected GitHub issue creation.
• limitrum_stripe_create_charge: protected Stripe charge dry-run.

Claude Desktop / Cursor MCP config:

{
  "mcpServers": {
    "limitrum": {
      "command": "limitrum-mcp-server",
      "args": [],
      "env": {
        "LIMITRUM_MCP_AGENT_ID": "agent_local"
      }
    }
  }
}

Protected tools are dry-run by default unless you explicitly enable execution with environment flags. See [docs/USEWITHAGENTSTACK.md](docs/USEWITHAGENTSTACK.md).

SSE mode:

pnpm --filter @limitrum/mcp-server dev:sse

The same SSE server also exposes a local HTTP verification gateway:

pnpm gateway:dev

curl -s http://localhost:8788/v1/verify-intent \
  -H "Content-Type: application/json" \
  -d '{"intent":{"agentId":"agent_local","action":"fetch","target":"api.unknown-exfil.io","amount":1}}'

SDK HTTP mode:

LIMITRUM_API_URL=http://localhost:8788 node your-agent.js

Set LIMITRUM_GATEWAY_API_KEY on the gateway to require X-Limitrum-API-Key or Authorization: Bearer ....

Website

Official site: https://limitrum.com

pnpm --filter @limitrum/web dev

Production build:

pnpm --filter @limitrum/web build

Quality Checks

pnpm typecheck
pnpm lint
pnpm test:unit
pnpm build
pnpm validate:runtime

Security

Please do not open public issues for vulnerabilities.

Report security issues through [SECURITY.md](SECURITY.md).

License

The open-source core is MIT licensed. See [LICENSE](LICENSE).

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Jayden-Siete
• Source: Jayden-Siete/Limitrum
• License: MIT
• Homepage: https://limitrum.com

Install and usage instructions live in the source repository linked above.