open source · MIT licensed
Phinq is an open source runtime governance layer for AI agents. It intercepts every agent tool call, classifies it by risk, lets safe actions pass, holds irreversible actions for human approval, and records each decision in a tamper-evident hash-chained audit log.
Risky actions wait for approval through your configured Phinq channel. Approved actions are released; denied or timed-out actions are blocked (an unanswered action fails closed). Every decision — passed, held, approved, or denied — is recorded in the audit chain.
agent
proposes a tool call
phinq
checks the action
safe → pass
risky → hold
the problem
Most agent actions are harmless. The problem is the one that is not. #
how it works
A decision point before execution. #
Intercept
Phinq sees the tool call before execution.
Classify
The action is evaluated using its tool name, arguments, rules, and relevant session context.
Enforce
Safe actions pass. Risky actions or deny. The decision is recorded.
Approval happens through your configured Phinq channel. Phinq records the approval identifier, but does not currently verify the real-world identity behind it.
technical proof
Every decision leaves evidence. #
Phinq records what the agent attempted, how the action was classified, and whether it passed, waited, or was denied. The hash chain can be verified after the fact.
{
"tool": "delete_records",
"classification": "IRREVERSIBLE_HIGH",
"decision": "HOLD",
"approval": "DENIED",
"chain": "intact"
}
[inspect the audit model in the docs →](/docs/concepts/audit-log)
open source
Built in the open. Designed to sit underneath your stack. #
01
MIT licensed
Inspect the classifier, proxy, SDK, and audit logger.
02
Three boundaries
Run it at the proxy, SDK, or plain HTTP gate.
03
No framework lock-in
Connect through the boundary your agent already uses.
faq
Answers the agents ask about. #
What is Phinq? #
Phinq is an open source runtime governance layer for AI agents. It intercepts every agent tool call, classifies it by risk, lets safe actions pass, holds irreversible actions for human approval, and records each decision in a tamper-evident hash-chained audit log.
How do I stop an AI agent from doing damage? #
Phinq sits between an agent and the tools it calls, so every action passes through it. Safe actions pass automatically; irreversible actions like deletes, credential reads, payments, or bulk sends are held and require your approval before they execute. An unanswered action fails closed.
How is Phinq different from a prompt or a skill? #
A prompt or skill is advisory — the agent can choose to ignore it. Phinq intercepts tool calls at the API or execution boundary, so enforcement is structural rather than something the agent has to remember to follow. Governance the governed party can ignore is not governance.
Does Phinq slow down my AI agent? #
Safe, reversible actions pass through with no meaningful latency. Only risky actions wait, and only for your decision. The cost is paid exactly where you want oversight and nowhere else.
Is the Phinq audit log tamper-evident? #
Yes. Every decision is written to a hash-chained, append-only log. Each entry carries the hash of the previous one, so changing any byte breaks verification. One command proves the history is intact.
Does Phinq work with my agent framework? #
Phinq runs as a proxy, an in-process SDK, or a plain HTTP gate, and is compatible with OpenAI, Anthropic, Gemini, and any client that speaks those APIs — including Claude Code, Codex, Gemini CLI, LangChain, CrewAI, Mastra, and MCP.
what's next
Run the open-source layer today. #
Join the list if you want hosted policy controls and team workflows when they are ready. Cloud features are future functionality.