Cordum is an action firewall and agent control plane for AI agents, positioned as a deterministic governance layer for probabilistic AI, enabling teams to define, enforce, and audit the behavior of autonomous AI agents across any framework or model.
Purpose and the problem it solves Enterprises are rapidly deploying autonomous AI agents but face insufficient risk control. According to Gartner data cited in the materials, 74% of enterprises view AI agents as a new attack vector, and more than 40% of agentic AI projects will be canceled due to insufficient risk control. The lack of a dedicated governance layer leads to: no visibility (what agents did can only be known after the fact), no guardrails (dangerous operations cannot be intercepted before execution), no human in the loop (sensitive operations have no human oversight), and no audit trail (the decision chain cannot be reconstructed after something goes wrong). Cordum solves this problem by enforcing policies and human approval before risky tool calls, shell commands, workflows, and production changes are executed, and by providing auditable evidence.
Governance framework: Before / During / Across
- BEFORE (governance): define declarative policies that are evaluated before an agent executes a job request; can trigger safety kernel checks, rate-limit risky actions, or flag operations as requiring human approval.
- DURING (safety): provide real-time visibility monitoring of running agents; monitor progress in real time, handle step-level approvals, and dynamically enforce timeouts or circuit breaking.
- ACROSS (observability): manage the entire agent fleet from a single control plane; aggregate audit trails, track capability-based routing, and observe agent pool health in real time.
Cordum Edge: a compliance firewall for AI agents Cordum Edge extends the control plane to local AI agent actions. For Claude Code, cordumctl edge claude starts the real P0 path: command hooks, local cordum-agentd, Gateway Edge API, Safety Kernel policy/evaluate, approvals, artifact pointers, and dashboard evidence. Its behavior is: deny reading .env; Edit/Write requires approval; safe reads pass through directly; the dashboard shows a live session timeline at /edge/sessions. For approved destructive operations, Edge Do not trust the approval storage alone: ProvenanceGate also requires a resolved approval audit event corresponding to the same tenant, approval_ref, and action_hash; a "request approval" event alone does not satisfy the provenance requirement; raw prompts, transcripts, and tool payloads do not enter the audit evidence. Documentation note: the wrapper is the developer/demo path; enterprise-grade enforcement requires managed Claude settings and endpoint control.
Install and Run (Option A: Install from Source) A single command brings up the full stack—API gateway, scheduler, security kernel, workflow engine, context engine, dashboard, NATS, and TLS-protected Redis—automatically generating keys, auto-configuring certificates, and running a post-deployment smoke test to exercise a real approval workflow. Prerequisites: Docker Desktop v4+ (or Engine v20.10+ with Compose v2, with at least 4 GB RAM allocated), Go 1.26.3+ (for first-time certificate generation), curl. On Windows, use MSYS2 / Git Bash / WSL. What you get when done: the dashboard is at http://localhost:8082，使用 admin / ChangeMe123! to log in (the default development password, also saved to .env as CORDUM_ADMIN_PASSWORD; change it before exposing the stack); the gateway is at http://localhost:8081，.env CORDUM_API_KEY is generated in; ./certs/ contains the TLS CA, server, and client key pairs; the built-in platform_smoke.sh runs a working approval-gated workflow.
Install and Run (Option B: Run Published Images) Prerequisites: Docker Desktop v4+ or Docker Engine v20.10+ with Compose v2 (at least 4 GB RAM), jq (recommended, for parsing API responses), Go 1.26.3+ (for one-time local certificate generation—docker compose will mount ./certs but will not create it). Dashboard:http://localhost:8082。此路径默认关闭用户认证，请在仪表板使用 Log in with CORDUM_API_KEY. To log in with an admin password instead, set CORDUM_USER_AUTH_ENABLED=true in .env along with a policy-compliant CORDUM_ADMIN_PASSWORD (at least 12 characters, including uppercase letters, numbers, and special characters), then run docker compose up -d (Option A's quick start script does this automatically). You can pin a specific version by exporting CORDUM_VERSION=1.2.3 and then running docker compose pull; the default is :latest, which only moves on stable release tags (pre-release suffixes such as -rc.1 do not promote :latest). Each release-tagged image is signed with cosign keyless OIDC; the documentation requires verifying all seven Cordum images individually before a production deployment, and verifying one image does not prove the rest. Container images are multi-architecture: linux/amd64 + linux/arm64. Helm: the documentation mentions that --set values enter the Helm release's stored values (and shell history), making it suitable for quick evaluation, but for production it is recommended to use redis.auth.existingSecret instead of redis.auth.password, and to patch secrets.apiKey into the rendered Secret out of band rather than passing it on the command line; the chart currently has no existingSecret equivalent for the API key. The Helm chart is also available on Artifact Hub.
Demo and Edge Quick Start Once the stack is up, install the demo-quickstart package and run the governance demo: a single hello, operator! workflow fans out to three topics and exercises every security kernel decision category within 30 seconds. Edge quick start: after the platform stack is up, point Claude Code at Cordum. The wrapper renders a temporary settings.json, spawns cordum-agentd on a local loopback nonce, and launches Claude Code with installed command hooks. For the full 30-minute walkthrough, see docs/quickstart-edge.md, seeSee docs/edge/README.md.
Developer path The published image path pulls the Cordum binary from ghcr.io. Contributors who need to rebuild from source use the development override file: docker-compose.dev.yml re-pins each Cordum service to the local cordum/<name>:dev tag and forces the build: context, so source changes take effect on the next --build; upstream images (NATS, Redis) are unaffected.
Protocols: CAP and MCP Cordum implements CAP (Cordum Agent Protocol), an open protocol designed specifically for distributed AI agent governance, providing a unified interface for defining agent capabilities, submitting jobs, and enforcing security policies across a heterogeneous pool of agents. CAP and MCP are complementary: MCP sits inside the agent and defines how the model invokes local tools; CAP sits above the agent and defines the governance control plane for the entire agent fleet. Use CAP for high-level orchestration and security gating, and MCP within the agent for fine-grained tool integration. Cordum includes an MCP server framework: standalone stdio mode via cmd/cordum-mcp (for local Claude Desktop/Code integration); Gateway HTTP/SSE mode via /mcp/message and /mcp/sse when mcp.enabled=true.
SDKs and integrations SDKs: Go (stable, this repository), Python (pip install cap-sdk-python), Node (npm install cap-sdk-node). The stable CAP Go, Python, and Node runtimes implement the same authenticated protobuf worker-trust contract. Legacy capability handshake or heartbeat is telemetry and does not constitute proof of identity unless bound to an accepted session. Deployments keep the explicit compatibility default CORDUM_SDK_HANDSHAKE=off + CORDUM_HEARTBEAT_MODE=authority until worker attestation keys and the control-plane signing authority are configured; before enabling warn or enforce follow the authenticated worker trust guide. Integration packages: 30+ integration packages covering Slack, GitHub, AWS, Jira, Terraform, Datadog, PagerDuty, and more. Each package is a CAP-native worker with policy-gated workflows.
Enterprise features (delivered in core, unlocked via license entitlements) SSO/SAML/OIDC integration + SCIM provisioning; advanced RBAC with role hierarchies; SIEM export (webhook, syslog, Datadog, CloudWatch); legal hold + rate rules + agent identity; priority support. The former standalone cordum-enterprise repository was retired on 2026-04-23.
Governance and licensing Cordum uses a transparent governance model with protocol stability commitments, a maintainer structure, and a clear decision-making process. Protocol stability: the CAP v2 wire format is frozen until February 2027. Versioning follows semantic versioning and a deprecation policy. The license is Business Source License 1.1 (BUSL-1.1): self-hosting and internal use are permitted; modification and contribution back are permitted; offering it as a competing hosted service is not permitted; change date January 1, 2029—automatically converts to the Apache License 2.0.
Limitations and caveats Default development passwords and keys must be changed before exposing the stack; production deployments must verify the cosign signature of every image individually; the Edge wrapper is a developer/demo path, and enterprise-grade enforcement requires managed Claude settings and endpoint controls; approval provenance only recognizes resolved approval audit events; worker trust configuration must be completed before enabling warn or enforce.
