squidbrake
squidbrake

Backed by Entrepreneur FirstChange control for AI agents

Agents propose.People approve.

Change control for AI agents. Everyday work runs on its own. When an agent wants to do something it can't take back, a teammate sees what it will change ("deletes 4,312 rows", "destroys the prod database") and says yes or no.

5,000+ PyPI downloads.

Sign up freeBuilding with agents yourself
Book a demoSecurity or platform team
Or try a command first, nothing to install ↓ Squidbrake - Change control for AI agents: sign-off, undo and a record | Product Hunt

The check takes 9 ms at p95. Your model takes seconds to decide. The check is the cheap part.

Inside the monitor

Four parts with one job: keep every agent inside the lines you drew, and stop it the moment it crosses one.

5,000+ downloads, including by engineers at

  • HCLTech
  • Urban Company
  • World Wide Technology
  • Airbyte
  • Juniper Networks
  • Pax8
  • Capslock
Backed by Entrepreneur First In Microsoft, OpenAI and Anthropic startup programs Meet the team →

Compare plans · Enterprise? Talk to us

Every step looks fine. The chain doesn't.

AI agents can now touch cloud, production and payments. Each action they take looks fine on its own, but a chain of fine actions can add up to something nobody authorized, like deleting a production database.

Squidbrake watches the whole chain and stops the step that makes the combination dangerous.

infra-agentMonitored

    Why now

    Agents got write access. Controls did not catch up.

    Ten publicly reported cases of AI agents causing damage, or coming close, replayed against the rules Squidbrake ships with. Nothing was written for the occasion, and the one it misses is shown too.

    Replays, not the original systems

    Public reports rarely publish the exact commands. Where we had to reconstruct them, each case says so.

    "Held" means a person decides

    Squidbrake doesn't know your intent. It makes sure a human sees the action, with the reason, before it runs.

    It guards what goes through it

    An agent with its own unguarded shell, credentials or network access can act outside it. Connect every path.

    python incidents/replay.py

    Clone the repo and run it yourself. The same scenarios run as tests on every change. Read the full benchmark

    What your team sees.

    Most calls run without anyone noticing. The few that matter wait for a person, with the reason attached.

    The Squidbrake dashboard. Three calls need approval: turning off backups on orders-prod, deleting orders-prod with no final snapshot (marked can't be undone), and a Stripe refund. Below, 88 total calls, 84 completed, 1 denied.
    1. The chain, in order. Backups turned off, then the delete. Both are held, and the delete is marked as one that can't be undone.
    2. Money waits for a person. The refund is held by rule and is denied automatically if nobody answers in ten minutes.
    3. One button stops everything. Stop agents halts every agent, one agent or one session.

    The real dashboard, unedited. Three agents made 88 calls on test data, with a pilot policy that lets routine build, test and read calls through: 84 ran on their own, one was blocked (rm -rf ~/) and three are waiting. Squidbrake 0.3.10, captured 3 Oct 2026.

    Every call, matched to a line you wrote.

    Policy is one YAML file in your repo. Read it, diff it, roll it back. Every decision names the rule that made it.

    rules.yaml34 lines
    1. default: review
    2. default_reason: A person approves anything that changes something
    3.  
    4. command_checks:
    5. catastrophic: block
    6. irreversible: review
    7. read_only: allow
    8.  
    9. rules:
    10. - id: allow-reads
    11. action: allow
    12. match: { name: ["Read", "Grep", "Glob"] }
    13.  
    14. - id: allow-tests
    15. action: allow
    16. match: { input_regex: '"command":\s*"(pytest|npm test)' }
    17.  
    18. - id: allow-db-maintenance
    19. action: allow
    20. match: { name: ["mcp__aws__rds_modify_*"] }
    21.  
    22. - id: refunds-to-finance
    23. action: review
    24. approvers: ["role:finance"]
    25. match: { name: ["mcp__stripe__*refund*"] }
    26.  
    27. sequences:
    28. - id: delete-after-backups-off
    29. action: review
    30. reason: Deleting a database right after its backups were turned off
    31. match: { name: ["mcp__aws__rds_delete_*"] }
    32. after:
    33. match: { input_regex: '"backup_retention_days":\s*0' }
    34. within_hours: 24
    Tool calls, one session
      1. Declare what it's for. Which tools run freely, which wait for a person, which never run.
      2. Fit the monitor. Each agent gets its own key, so every call is tied to one agent and can be cut off on its own.
      3. Watch the whole chain. A step that looks fine alone is held when it completes something dangerous.
      4. Cut off in a second. Held for review or blocked, and access revoked in one call.

      Real decisions, not a mock-up: these nine calls were run through Squidbrake 0.3.10 with exactly this file on 3 Oct 2026, and each highlight is the line that decided the call.

      Not only coding agents.

      Support, finance and ops agents make the changes that cost money. They go through the same rules, the same chain checks and the same person.

      1. Support agent

        A ticket asks for a $900 refund to a different card than the one that was charged.

        HeldRefunds wait for a person, who sees the ticket that asked for it.

      2. Finance agent

        An email from ceo.office@acrne.com asks for an urgent $24,800 wire.

        BlockedMoney moving right after a message from a look-alike of your domain.

      3. Data agent

        A ticket from a "data partner" asks for the full customer export, by email.

        HeldAn email to an outside address waits for a person.

      4. Ops agent

        Pins a customer to an older version, changes their plan, flips a feature flag, through your own tools.

        Held by defaultA change through a tool it doesn't know waits for a person. Reads run.

      The first three are sessions from the benchmark, replayed against the shipped rules. The fourth is what happens to any tool you connect before you write a rule for it.

      Why not just use what you already have?

      Each of these judges one request at a time, or lives where the model can talk its way past it. A dangerous chain is several requests that are fine alone.

      CapabilitySquidbrakeIAMPolicy engineOPA, CedarAPI gatewayIn-agent guardrail
      Remembers what the agent did beforeYes, across sessions and agentsNoNo, statelessNoOnly in the prompt
      Reads the actual commandYes, parsedSees the API actionIf you write itMethod and pathYes
      Out of the model's reachYesYesYesYesNo, can be injected
      Holds one step for a personSlack, phone, dashboardNoNoNoAsks in the chat
      Approved by someone other than the person running the agentYesNoNoNoNo, the same person
      Shows what it will change before approvalRows, resources, commits, filesNoNoNoThe raw command

      9 ms at p95. Measured, not promised.

      Squidbrake sits inline between an agent and its tools. Every call is checked against your rules, the command it runs and the agent's recent actions. Across 1,000 mixed calls against the shipped rules, half were answered in 3.3 ms and 95% in 9 ms.

      Your model takes seconds to pick a tool. The check is the cheap part, and a blocked call never reaches the tool at all.

      Measured 3 Oct 2026 on a laptop: server and caller on the same machine, SQLite, the shipped rules.yaml. A network hop adds its own round trip.

      Built for teams that answer to an auditor

      On the roadmap

      • SSO and SCIM
      • A data region you choose
      • An uptime SLA

      Available today

      Runs in your cloud
      Docker image, Compose file or systemd unit. SQLite to start, Postgres when you need it. Your data stays with you.
      Second-person approval
      Held calls go to Slack, Discord, the dashboard or a one-tap phone link. Nobody approves their own agent's request, and refunds can go to finance.
      Shows what it will change
      Measured before anyone approves: rows a DELETE would remove, resources a terraform destroy would take (and which hold data), commits a force push would erase, objects in a bucket.
      Undo
      Right before an approved delete, git reset or git clean runs, Squidbrake keeps a copy. One command puts it back.
      One policy on every laptop
      Lockdown uses the agents' own managed settings, so Claude Code, Cursor, Codex and Gemini CLI all run Squidbrake and bypass modes stay off.
      Evidence for your auditor
      Every decision is hash-chained and can be verified offline. One click makes a one-page evidence pack: the controls, who approved what, what was blocked. It supports SOC 2 change-management evidence.
      Streams to your SIEM
      Every decision, as it happens, to Splunk, Datadog or an OpenTelemetry collector. Secrets are redacted first, and a slow SIEM never slows an agent.
      Kill switch
      Stop every agent, one agent or one session in a single call. A removed key stops working at once.
      Shadow mode
      Log what would have been blocked, without blocking anything, before you turn enforcement on.

      Running in five minutes.

      It works on the tool call, so the model and the framework behind it don't matter. Three ways in:

      1. Coding agents on a laptop. squidbrake connect all finds Claude Code, Cursor, Codex and the rest, and routes every tool call through it.
      2. Agents that connect by URL. Add the app's MCP server in the dashboard, then give ChatGPT, Devin or n8n its Squidbrake URL.
      3. Agents you build. One line puts every tool behind it: tools=gw.guard_tools([...]).

      Everything it connects to · Using something else? If it makes tool calls, we can wrap it. Ask us

      TerminalFull quickstart
      $ pipx install squidbrake
$ squidbrake connect all
$ squidbrake

# then, in Claude Code: "clean up the test artifacts"
Bash(rm -rf tests/ patches/ plan/ ~/)
Squidbrake blocked this (rule 'command:catastrophic_command'):
This command deletes your home folder (rm -rf tests/ patches/
plan/ ~/). Don't try to work around it.

      Connects to what your agents already use.

      Coding agents on laptops, agents in the cloud, agents your team builds, and the apps they all reach. One policy, one log, one place to approve.

      Coding agents

      squidbrake connect all

      • Claude Code
      • Cursor
      • Codex CLI
      • Gemini CLI
      • VS Code Copilot
      • Antigravity
      • WindsurfMCP tools
      • KiroMCP tools
      • Claude DesktopMCP tools

      Agents that connect by URL

      One URL from the dashboard

      • ChatGPT connectors
      • claude.ai connectors
      • Devin
      • n8n
      • Any MCP client

      Agents you build

      gw.guard_tools([...]) or one HTTP call

      • OpenAI Agents SDK
      • LangChain
      • LangGraph
      • CrewAI
      • PydanticAI
      • smolagents
      • Google ADK
      • Any language, over HTTP

      Approvals reach people in

      With the reason and what it will change

      • Slack
      • Discord
      • A one-tap phone link
      • Phone notifications (ntfy)
      • The dashboard

      Apps your agents use

      Any MCP server, local or remote

      Pick it in the dashboard, paste its token

      • GitHub
      • Stripe
      • Linear
      • Jira and Confluence
      • Sentry
      • Supabase
      • Neon
      • Cloudflare
      • Intercom
      • Airtable
      • Zapier
      • Make
      • monday.com
      • PagerDuty
      • Context7
      • Exa
      • Firecrawl

      Run on a laptop or your own gateway

      • Notion
      • Square
      • PayPal
      • MongoDB
      • Grafana
      • Postgres
      • Filesystem
      • Playwright
      • Brave Search
      • Twilio
      • Any other MCP server

      Not yet: hosted servers that only sign in through a browser

      • Slack
      • HubSpot
      • Asana
      • Vercel
      • Figma
      • ClickUp
      • Google Workspace
      • Salesforce (hosted)

      Checked against the real apps: Claude Code, Cursor, Codex CLI, Gemini CLI, the OpenAI Agents SDK and LangChain. The others are covered by tests of their documented hook or MCP formats. Product names are trademarks of their owners; Squidbrake isn't affiliated with them.

      Questions security teams ask first

      Does any of our data leave our network?

      No. Squidbrake runs where you run it, on a laptop or in your cloud. Tool calls, results and the audit log stay in your database.

      Does it use an LLM to decide?

      No. Decisions come from your rules, a command parser and the agent's recent history. The same call gets the same answer every time, and every answer names the rule that made it.

      What happens if Squidbrake is down?

      You choose. By default a call that can't be checked doesn't run. Set GATEWAY_FAIL_OPEN if you'd rather keep agents moving.

      Can the agent get around it?

      It's built for the common case: a cooperative agent that makes a mistake, or follows instructions it read in an email, a web page or an issue. Everything that goes through a connected tool is checked outside the model, where a prompt can't rewrite it. That includes the agent trying to change its own settings or Squidbrake's rules, which waits for a person. It doesn't see inside a script the agent writes and then runs, or tools you haven't connected. For an agent you don't trust at all, run it in a sandbox too.

      Doesn't auto mode already handle this?

      Keep auto mode for everyday work: it should decide the 99% of steps that are easy to undo. Squidbrake is for the 1% you can't take back, and there the person running the agent shouldn't be the only one saying yes. A teammate approves, with the effect in front of them, and a wrong yes can often be undone.

      How does this help with SOC 2?

      SOC 2's change-management control asks that changes be authorized and approved. Once agents change production, your auditor will ask who approved what they changed. Squidbrake records a second person's approval for every risky step in a tamper-evident log, and the evidence pack puts it on one page. It supports your evidence; your auditor decides what it satisfies.

      Will it slow our agents down?

      The check takes 3.3 ms at the median and 9 ms at p95 on a laptop. A model takes seconds to choose a tool.

      How do we start without breaking anything?

      Turn on shadow mode. For the first week nothing is blocked. You see what would have been, then decide what to enforce.

      Let agents propose. Let people approve.

      Start in shadow mode. Nothing is blocked in week one. You see what would have been.

      Sign up freeBook a demo

      Talk to the founders

      30 minutes. Bring an agent you're nervous about, and we'll replay its riskiest tool calls against Squidbrake while you watch.

      Choose a time

      No call? Leave your email

      We'll only use your email to contact you about Squidbrake.

      Demo requested.

      We'll email you to schedule your demo.