AgentVeil (avp-sdk) is an independent control layer for AI agent actions, positioned as a policy boundary outside the agent runtime. It does not replace any agent runtime, but instead mediates around action paths configured to pass through it. When a native or risky action reaches this boundary, AgentVeil makes one of four decisions: allow, approval_required, redirect (pointing to a controlled path), or hard-block. Routed MCP calls follow the same decision model and record bounded local evidence. It is officially emphasized that AgentVeil is not machine-level control; actions not configured within the AgentVeil boundary are not classified or recorded.
The main capabilities revolve around a product loop (The AgentVeil Loop): approvals are used for actions requiring human review; redirects prompt the agent to retry when a controlled MCP path exists; hard blocks mean the action would not help even if approved; local proof is obtainable through the CLI rather than a future dashboard page. AgentVeil has two public action control surfaces: first, project connectors, configured per project/workspace, which install hosted local hooks and MCP routing configuration, block supported native risky mutation tools, return redirect guidance pointing to AgentVeil MCP tools, and use the MCP proxy's approval and evidence mechanisms for routed tool calls; second, the core MCP proxy, which wraps downstream MCP servers, classifies routed MCP tool calls, returns allow / approval_required / redirect / policy-stop results, and records bounded local evidence.
In terms of usage, you can sign in from the console (agentveil.dev/console/auth) with GitHub or Google, select an agent, and run the command shown in the console. Supported project connectors include Cursor, Claude Code, Codex, and Gemini CLI, each installing project-local hooks by selecting the project folder to protect and reloading the corresponding client; Codex and Gemini CLI will ask once to trust the project hooks or folder. Hermes CLI is then launched through AgentVeil, configuring a project-local Hermes home and routing Hermes to AgentVeil MCP tool. For lower-level MCP routing, you can directly run the core MCP proxy path to explicitly point MCP tool calls to agentveil-mcp-proxy. Verification methods include: having the agent read project context (such as list_workspace, read_file, get_file_info, instruction_surface_status should be allowed); having the agent create or edit files (should be blocked with redirection guidance, then go through the controlled MCP route and trigger approval); opening the approval page to review bounded proof details; using the CLI to inspect local proofs, where the default human-readable output includes lines such as decision=approval_required, tool=write_file, and using --json to obtain structured fields.
Regarding evidence, AgentVeil records bounded local evidence for controlled actions, allowing you to see what the agent requested, how the policy decided, whether approval was required, and whether the action was executed; by default it records hashes and bounded metadata rather than raw prompts or full payloads. This mechanism is suitable for AI agent governance, compliance review, and debugging of unsafe automation. Design principles include fail-safe defaults (missing policy, missing approval, or unavailable trusted decisions tend toward denial or explicit review), full mediation of routed calls, least privilege, separation of powers, and bounded evidence.
Regarding limitations, AgentVeil does not claim machine-level control: it does not control the entire machine, does not globally control every Cursor / Claude / Codex / Gemini / Hermes chat, does not globally control every autonomous agent runtime, does not control manual terminal commands outside the configured paths, does not control IDE actions outside the supported agent tool surfaces, does not control MCP servers not routed through AgentVeil, does not control disabled/removed/bypassed hooks, and does not control unsupported client modes that skip hooks. As of now, available capabilities include: MCP proxy for routed MCP tool calls, project-local Cursor / Claude Code / Codex / Gemini CLI connectors, Hermes CLI controlled MCP launch configuration, approval/redirection/blocking/evidence results for routed actions, and bounded local evidence export. Capabilities provided as SDK/protocol primitives include capability token primitives, local identity helpers, delegation receipts, and proof package helpers. Preview/Design partner processes include session token flows, richer policy packages, credential hosting, egress boundaries, managed approvals, and team governance. Public connectors do not include machine-level shell interception, global client locking, automatic control of unrelated chats, private enterprise policy packages, managed authentication/licensing/telemetry, or enterprise managed logic. The root SDK is MIT licensed, and agentveil-mcp-proxy is a separately packaged source-available component under the BUSL-1.1 license. The Python SDK also includes framework examples and optional helper modules for CrewAI, LangGraph, AutoGen, PydanticAI, OpenAI, Gemini, and AWS Bedrock, but these examples are not equivalent to project connectors.
