Launching today
CtrlAI
Transparent proxy that secures AI agents with guardrails
39 followers
Transparent proxy that secures AI agents with guardrails
39 followers
CTRL-AI v1 is a transparent HTTP proxy that sits between your AI agent and LLM provider, enforcing guardrails, auditing behavior, and blocking unsafe tool calls — with zero SDK modification required.
CirtusAI
Your AI agent just Slacked your CEO "you're a terrible leader" at 3am.
That's the thing about autonomous agents. They don't just write code. They send messages, execute shell commands, read your SSH keys, snap photos from paired devices, and make API calls. One hallucinated tool call is all it takes.
CTRL-AI sits between your agent SDK and the LLM provider as a transparent HTTP proxy. Every tool call the model attempts passes through your rules before anything executes.
What it does:
Intercepts every LLM response, both streaming and non-streaming, across Anthropic, OpenAI, Moonshot, Qwen, MiniMax, and Zhipu (support for other providers will follow soon).
Evaluates tool calls against configurable guardrail rules. Block SSH key access, credential exfiltration, destructive commands, camera or location access, unsolicited messaging, and more.
Blocks dangerous tool calls and rewrites the response so your SDK thinks the model simply chose not to call the tool. Your agent does not crash. It just moves on.
Logs everything to a tamper-proof, SHA-256 hash-chained audit trail with daily rotation and SQLite indexing.
Provides an emergency kill switch that instantly terminates any agent mid-session. It takes effect within seconds and requires no restart.
Ships with 23 built-in security rules enabled out of the box.
Multi-agent, multi-provider:
Run multiple agents through a single proxy, each with its own identity, rules, and audit trail. Route agent "main" through Anthropic and agent "work" through OpenAI using the same proxy with separate policies. Kill one agent without touching the others.
/provider/anthropic/agent/main/v1/messages
/provider/openai/agent/work/v1/chat/completions
Per-agent identity means your audit log tells you exactly which agent did what, when, and whether it was allowed. No more guessing which agent read that .env file.
Zero code changes. Just point your agent's baseUrl to CTRL-AI. Your SDK does not know it is there. Works with any framework that supports custom base URLs. Built for OpenClaw and compatible with everything else.
What you get in 60 seconds:
ctrlai start
Proxy on :3100. Dashboard at /dashboard. Live WebSocket feed. CLI for rules, audit, and kill switch. Hot-reloadable config. Edit rules while the proxy is running.
Built for developers shipping autonomous agents to production.
Open-source under MIT. Self-host it, extend it, own it.
Enterprise with centralized policies, SSO, and managed deployment: enterprise@cirtusai.com
The ‘rewrites the response so the SDK thinks the model chose not to call the tool’ line is the most interesting design choice here — it’s not just blocking, it’s state preservation.
A blocked tool call that returns an error triggers the agent’s error-handling logic (which may cascade badly). A clean no-op keeps the agent on the happy path. The agent doesn’t know it was constrained — it just didn’t act.
The open question: what happens when the blocked action was load-bearing? An agent that keeps ‘not calling’ a tool it expects to work may develop a subtly distorted world model over time. Curious how the audit trail helps correlate these silent interventions with downstream behavior.
CtrlAI
CtrlAI