Product
A control plane at the agent's action boundary.
InterceptAI fronts your tools over MCP and governs every consequential action before any side effect happens — independent of the agent platform and the tools it calls. Four steps, each one recorded.
Intercept
Catch each tool call at the boundary — over MCP today; the SDK and egress next.
Score
Rate the consequence by irreversibility, blast radius, and drift from delegated intent.
Enforce
Apply your policy and pick the right response.
Record
Write an append-only, hash-chained entry of authorized-versus-actual.
The four responses
One decision per action — matched to its consequence.
allow
Low-consequence actions pass straight through, recorded but never slowed — the fast path carries a load-tested ≤ 40 ms P50 added-overhead budget.
hold
Park the action and wait for a human to approve or deny in the console. The hold survives a restart (it is a database row), and routes to the right reviewer group.
block
Refuse a destructive action outright — no downstream call is made, and the record cites the policy that stopped it.
wrap → undo
Let a write run reversibly: snapshot before, and a one-click undo after — so a wrong-but- permitted change can be put back.
What's inside
Consequence scoring, delegated intent, and multi-agent attribution.
Consequence-first scoring
A deterministic scorer rates irreversibility, blast radius, and sensitivity, with an optional judge for semantic intent-drift. The band (low → critical) drives the policy.
Delegated-intent envelopes
Sign what an agent was authorized to do, then measure each action against it — so the record is authorized-versus-actual, not just a log of what ran.
Multi-agent chain attribution
When one agent spawns another, the resolved delegation chain (originator → … → actor) is attributed on every action — so liability is traceable across a chain.
Authorable, versioned policy
Write policies as first-match rules on band, tool, and surface; activate, roll back, and shadow-test a candidate against real history before it enforces.
Runs on your terms
Self-host, observable, and safe under load.
Self-host first
Docker Compose or Helm, your Postgres and your identity provider. Nothing phones home; the fast path pays nothing for features you have not turned on.
Fails safe, not open
If scoring or the record is unavailable, a high-consequence action holds — it never silently proceeds. Health probes and graceful shutdown keep rolling deploys clean.
Observable
OpenTelemetry spans and metrics, structured logs, per-tenant rate limiting, and a latency SLO you can assert in CI.
The record is where accountability lives — see the security & trust story, or get started.