Claude breached 3 firms. Phinq holds the tool call that would've stopped it

Phinq, an open source runtime governance layer for AI agents, intercepts every agent tool call, classifies it by risk, holds irreversible actions for human approval, and records each decision in a tamper-evident hash-chained audit log. The MIT-licensed tool is designed to prevent incidents like the one where Claude breached three firms, by structurally enforcing governance at the API or execution boundary. Phinq supports OpenAI, Anthropic, Gemini, and any client that speaks those APIs, including Claude Code, Codex, Gemini CLI, LangChain, CrewAI, Mastra, and MCP.

open source · MIT licensed Runtime governance for AI agents Phinq is an open source runtime governance layer for AI agents. It intercepts every agent tool call, classifies it by risk, lets safe actions pass, holds irreversible actions for human approval, and records each decision in a tamper-evident hash-chained audit log. Risky actions wait for approval through your configured Phinq channel. Approved actions are released; denied or timed-out actions are blocked an unanswered action fails closed . Every decision — passed, held, approved, or denied — is recorded in the audit chain. agent proposes a tool call phinq checks the action safe → pass risky → hold the problem Most agent actions are harmless. The problem is the one that is not. how it works A decision point before execution. read the full lifecycle → /docs/concepts/how-phinq-works Intercept Phinq sees the tool call before execution. Classify The action is evaluated using its tool name, arguments, rules, and relevant session context. Enforce Safe actions pass. Risky actions pause or deny. The decision is recorded. Approval happens through your configured Phinq channel. Phinq records the approval identifier, but does not currently verify the real-world identity behind it. technical proof Every decision leaves evidence. Phinq records what the agent attempted, how the action was classified, and whether it passed, waited, or was denied. The hash chain can be verified after the fact. { "tool": "delete records", "classification": "IRREVERSIBLE HIGH", "decision": "HOLD", "approval": "DENIED", "chain": "intact" } inspect the audit model in the docs → /docs/concepts/audit-log open source Built in the open. Designed to sit underneath your stack. 01 MIT licensed Inspect the classifier, proxy, SDK, and audit logger. 02 Three boundaries Run it at the proxy, SDK, or plain HTTP gate. 03 No framework lock-in Connect through the boundary your agent already uses. faq Answers the agents ask about. What is Phinq? Phinq is an open source runtime governance layer for AI agents. It intercepts every agent tool call, classifies it by risk, lets safe actions pass, holds irreversible actions for human approval, and records each decision in a tamper-evident hash-chained audit log. How do I stop an AI agent from doing damage? Phinq sits between an agent and the tools it calls, so every action passes through it. Safe actions pass automatically; irreversible actions like deletes, credential reads, payments, or bulk sends are held and require your approval before they execute. An unanswered action fails closed. How is Phinq different from a prompt or a skill? A prompt or skill is advisory — the agent can choose to ignore it. Phinq intercepts tool calls at the API or execution boundary, so enforcement is structural rather than something the agent has to remember to follow. Governance the governed party can ignore is not governance. Does Phinq slow down my AI agent? Safe, reversible actions pass through with no meaningful latency. Only risky actions wait, and only for your decision. The cost is paid exactly where you want oversight and nowhere else. Is the Phinq audit log tamper-evident? Yes. Every decision is written to a hash-chained, append-only log. Each entry carries the hash of the previous one, so changing any byte breaks verification. One command proves the history is intact. Does Phinq work with my agent framework? Phinq runs as a proxy, an in-process SDK, or a plain HTTP gate, and is compatible with OpenAI, Anthropic, Gemini, and any client that speaks those APIs — including Claude Code, Codex, Gemini CLI, LangChain, CrewAI, Mastra, and MCP. what's next Run the open-source layer today. Join the list if you want hosted policy controls and team workflows when they are ready. Cloud features are future functionality.