Approval gates for every write, OpenAPI connectors, and bidirectional MCP — what's new in Baize

Baize is a self-hosted sidecar that puts your existing internal APIs and tools behind an LLM agent, with a human checkpoint before anything that changes state. Here's what's new.

1. Human approval before every write

The agent can read freely, but any tool that changes state — closing an order, deleting a record, shipping a shipment — pauses and asks a person first. The approval card shows the evidence it gathered, the exact tool (with content hash and revision), and the arguments it's about to run. You approve or reject; nothing happens by surprise.

2. Per-tool governance, not a global switch

Every imported tool has its own enable/disable and "requires approval" toggle. Read-only calls can run straight through; writes require sign-off. You set the boundary at the granularity of individual endpoints instead of trusting the whole connector.

3. Turn an OpenAPI doc into a governed tool catalog

Point Baize at an internal OpenAPI/Swagger spec and the operations become tools, with no per-endpoint glue code. Here the open-source mall demo's spec imports as 160 tools, with the three order-writing operations gated and the read endpoints left open.

4. MCP in both directions

In: connect standard MCP servers (Notion, or anything else) and use their tools alongside your own.

Out: expose Baize's governed tools as a standard MCP endpoint, so Cursor, Claude Desktop, or any MCP client gets the same approval and audit guarantees.

5. Also shipped

Two ways to reach the runtime on mobile — a zero-code remote console (a Capacitor shell) and an on-device Go SDK (gomobile) for branded apps — with keys held in the platform secure store and the same approval protocol.

Why

Agents that can only chat are safe but not very useful; agents wired straight to production APIs are useful but dangerous. Baize sits in the middle: connect once, govern per tool, approve every write, and keep an auditable, replayable record per run.

Try it / read more

Repo (Go, single binary, MIT): https://github.com/rebornace/baize

Docs: https://rebornace.github.io/baize

Architecture deep dive: https://dev.to/rebornace/from-a-single-agent-loop-to-an-auditable-runtime-baizes-architecture-5b5e

MCP in and out: https://dev.to/rebornace/connect-your-business-apis-once-share-them-with-every-agent-client-via-mcp-n3h

If you're wiring agents to internal systems, I'd love to hear how you handle approval boundaries and tool governance today.