The runtime

The execution trust layer for AI agents. Every AI action becomes an event the runtime can understand, evaluate, authorize and prove, and it makes a deterministic decision before anything executes.

It is Apache-2.0 licensed, runs on your own machines, and needs no account, no API key and no network call to do its job.

Every action walks the same five stages, on your own machine. The verdict is settled by the first stage with something to say about it, a blocked call never reaches the ones after it.

What it is not

It is a gate, not a reviewer. It answers "does this violate a rule?", never "is this good code?".

It reads your repository to know what a change reaches, reads a diff to catch a secret, and reads a tool call to decide on it. It does not generate, edit or commit anything, does not review pull requests, and runs no sandbox.

Governing an agent and being an agent do not belong in the same trust boundary.

Running it

bash

npx memnox setup        # scaffold, hook, and serve: the normal path
memnox serve            # just the server, explicit flags only

setup turns guards on because a laptop wants them on. serve keeps its explicit-flag contract, so a server deployment never gains a guard because a local default moved.

Once more than one machine runs it, four flags matter:

bash

memnox serve \
  --database-url postgres://… \
  --redis-url redis://… \
  --audit-retention-days 365 \
  --rate-limit 600

Flag

--database-url <url>

Postgres, holding identity, approvals and the audit trail. Leave it out and each replica keeps its own files, so an approval granted on one is invisible to the other.

--redis-url <url>

Redis, holding the rate-limit budget and the taint store. It is what makes those one budget across every replica instead of one each.

--audit-retention-days <days>

Delete audit events older than this many days. 0 means keep everything.

--rate-limit <rpm>

How many checks one agent may make per minute. 0 turns the limit off.

Both connection strings can come from MEMNOX_DATABASE_URL and MEMNOX_REDIS_URL instead, which keeps a password out of the process list.

Three deployment shapes

	Solo	Team	Enterprise
Setup	`npx memnox init && npx memnox serve`	`--database-url` + `--redis-url`	above + the hosted cloud
Account required	none	none	SSO via your IdP
Storage	JSON/JSONL files	shared Postgres	Postgres + retention policy
Approvals	CLI	Slack buttons, RBAC API keys	Slack + OIDC identities
Audit	hash-chained JSONL	shared, verifiable	+ CSV export, retention
Multi-org	✗	✗	`orgId` on every record

Solo genuinely means zero infrastructure. Everything above it is additive, nothing about the solo path changes when a team adopts it.

What it is made of

Small pieces, deliberately. The policy engine has zero dependencies, storage sits behind interfaces so the local file adapters and the Postgres ones are the same code path, and the optional intelligence layer has no route into the decision path at all.

You do not need to know any of that to run it. It matters because it is the reason "no account required" is true rather than a marketing line, and because you can read the thing that governs your agents.

If you want the package map and the dependency rules, they are on How the code is laid out.

Scaling

Rate limiting. Without Redis each pod counts on its own, N pods means N× the configured limit. With it, one fixed-window budget is shared. If the URL is set but Redis is unreachable, startup fails rather than silently degrading.
Session taint. Redis also holds the taint store, lock-guarded, 7-day TTL.
Audit retention. --audit-retention-days prunes on an hourly sweep. The Postgres delete is batched so it never holds a long table lock, and one distributed lock keeps a single pod sweeping.
Bounded reads. Advisors ask for a fixed recent window, pushed into SQL rather than applied afterwards.
Multi-tenancy. Records carry an optional orgId, indexed and filterable.

Metrics

GET /v1/metrics serves Prometheus text: actions by effect and risk level, approvals pending and resolved, rate-limit rejections, audit append failures. Counters are per-process, summing across pods is the scrape layer's job.

Design principles

Deterministic core. No LLM, no network calls, no randomness in the decision path.
Fail closed. Unknown identity, unreadable state or ambiguous input blocks rather than guesses.
Everything auditable. A decision that cannot be proven afterwards did not happen.
Small, inspectable pieces. You should be able to read every line of the thing that governs your agents.
Ports over lock-in. Any backend can implement the storage interfaces.

Protect your agents

Getting the gate in front of Claude Code, Cursor, MCP and custom loops.

Runtime API

Every endpoint the runtime exposes.