AgentControl AgentControl is an open-source runtime control plane for AI coding agents that intercepts every tool call, enforces YAML-defined policies, requires human approval for risky operations, and logs all activity. The tool acts as a cloud firewall for AI agents, supporting features like risk-level enforcement, agent registry, audit timeline, and self-hosted deployment via Docker. Open-source runtime control plane for AI coding agents Think "cloud firewall for AI agents." AgentControl sits between your agent and its tools — intercepting every tool call, enforcing policy, requiring human approval for risky operations, and logging everything. ┌─────────────────────────────────────────────────────────┐ │ AgentControl Dashboard │ │ ┌─────────────────────────────────────────────────────┐ │ │ │ Agents │ ON │ Name │ Risk │ Actions │ │ │ ├─────────────────────────────────────────────────────┤ │ │ │ ◉ ON │ repo-mnt │ Repo Bot │ HIGH │ ⏸ 🗑 │ │ │ │ ◯ OFF │ safe-bot │ Safe Bot │ LOW │ ▶ 🗑 │ │ │ └─────────────────────────────────────────────────────┘ │ │ Policy: block rm -rf, require approval for PR merges │ │ Audit: 47 tool calls logged, 12 blocked, 3 approvals │ └─────────────────────────────────────────────────────────┘ Record a live demo: npm install -g terminalizer && terminalizer record demo npm install cp .env.example .env npm run dev Open http://localhost:8080 — the dashboard is live. That's it. | Problem | Solution | |---|---| Agent runs rm -rf / | Blocked by dangerous-command guardrails | | Agent wants to merge a PR | Requires human approval in the dashboard | Agent accesses .env secrets | Blocked by path-traversal guardrails | | You need an audit trail | Every tool call logged with decision, approval, and result | | Multiple agents, different trust levels | Risk-level enforcement: low auto-allows, high requires approval, critical blocks all | | You want to pause an agent | Toggle on/off from dashboard or CLI | Policy Engine — YAML-defined rules that decide allow , block , or require approval per tool call Agent Registry — Register agents with identities, allowed tools, and risk levels Human-in-the-Loop — Approve or deny risky tool calls from the dashboard or API Audit Timeline — Complete replay of every tool call, decision, and approval Dashboard UI — Single-page HTML app: monitor agents, approve calls, view audit logs CLI — Full command-line interface for scripting and automation API Key Management — Create and revoke scoped API keys via the dashboard or CLI Risk Levels — low / medium / high / critical — each enforces different policies Enable/Disable Agents — Stop or start agents without deleting them Docker — One-command deploy with docker compose up -d Self-Hosted — Your data stays on your infrastructure. No cloud dependency. ┌──────────┐ ┌──────────────────────────────────────────┐ ┌──────────┐ │ Agent │────▶│ AgentControl Gateway │────▶│ Tools │ │ LLM │ │ │ │ shell, │ └──────────┘ │ ┌──────────┐ ┌──────────┐ ┌────────┐ │ │ files, │ │ │ Policy │──│ Approval │──│ Audit │ │ │ github │ │ │ Engine │ │ Queue │ │ Log │ │ └──────────┘ │ └──────────┘ └──────────┘ └────────┘ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌──────────────────────────────────────┐ │ │ │ Agent Registry │ │ │ │ SQLite: agents, policies, runs │ │ │ └──────────────────────────────────────┘ │ └──────────────────────────────────────────┘ Every tool call passes through the gateway: Policy Engine evaluates the call against YAML rules and risk level Approval Queue holds calls that need human review Audit Log records the full decision + execution trace Register an agent npm run cli -- agent register \ --id repo-maintainer \ --name "Repo Maintainer" \ --owner engineering \ --environment development \ --purpose "Safely maintain repository tasks" \ --tools shell.run,filesystem.read,filesystem.write,github.mock merge pr \ --risk medium Try allowed commands npm run cli -- tools call --agent repo-maintainer --tool shell.run --input '{"command":"npm test"}' Dangerous commands are always blocked npm run cli -- tools call --agent repo-maintainer --tool shell.run --input '{"command":"rm -rf /"}' High-risk tools need approval npm run cli -- tools call --agent repo-maintainer --tool github.mock merge pr --input '{"repo":"company/api","pr":42}' Approve from CLI npm run cli -- approvals list npm run cli -- approvals approve