CTRLRun stops AI agents from taking wrong, restricted, or malicious actions in your workflows.
Every action is checked against your rules before it runs. Allowed actions go through.
Sensitive ones wait for a person. Forbidden ones are blocked.
The ticket says refund €500. The agent asks for €5,000, one extra zero. The tool is in its list, the arguments are well formed, and the model is completely confident. Without CTRLRun, nothing checks the amount and the call goes through: €4,500 too much. With CTRLRun, your rule checks the amount and the call never leaves: €0 wrongly paid.
The other failure is the one people forget. An agent refunds €500, the call commits at the
provider, and the reply is lost on the way back, so the agent sees an error and retries. The bug
is not the retry. It is that the agent had no way to tell this failed from I do not know
what happened. CTRLRun keeps them apart: a lost reply is AMBIGUOUS, never FAILED, and a
retry against an AMBIGUOUS effect is refused until a human, or a reconcile hook, says what
happened.
pip install ctrlrun && ctrlrun demoFive ways an agent action goes wrong and what stops each one, in under a second, with no network.
ctrlrun: execution safety for AI agents. A Python library that sits between the decision to act and the call that acts. A consequential action happens at most once, exactly as approved, and leaves a receipt. Apache-2.0.
Runs on a single SQLite file, or on Postgres across hosts. The core installs pyyaml and click
and nothing else. An MCP gateway puts the same check in front of agents you can't modify: WhatsApp,
Slack and Teams bots, ChatGPT, Cursor, Codex. Framework adapters, OpenTelemetry and JWT identity
ship as optional extras.
- docs.ctrlrun.dev: the documentation, and why in 700 words
- Try it in the browser: no Python; break a protected action in a tab
- Where it stops: the limits, written down
- Discussions · Security policy
