Lelu

Authorization engine for AI agents.
Every action checked. Every decision logged. Humans in the loop when it matters.

Live Sandbox · One-Command Start · Claude Code Plugin · Examples · MCP Server · Contributing · Discussions

---

What is Lelu?

Lelu is an open-source authorization engine that sits between your AI agent and the real world. Before the agent takes any action — issuing a refund, sending an email, deleting a record — it asks Lelu first, and Lelu returns one of four decisions:

• ✅ allow — the action runs
• ⛔ deny — blocked, with a reason
• 🙋 human_review — the agent pauses until a human approve
• 🧪 compute — redirected to a safer alternative or sandbox

It's one HTTP call from any language or framework, every decision is written to an audit log, and the engine runs entirely on your own machine or infrastructure.

Why Lelu?

Give your agent a permission system it can't talk its way around.

Okta tells you who can do what. Lelu tells you when they're doing it wrong. Traditional auth tools (OPA, Casbin, AWS AVP) block unauthorized access — they can't detect when a legitimately authorized agent is being manipulated by prompt injection, acting on low confidence, or behaving anomalously. Lelu closes that gap.

OPA, Casbin, and AWS AVP handle role & permission checks, but stop there. Lelu does that too, and adds:

• Prompt-injection detection (5-layer filter)
• LLM confidence gating on verified log-probs
• Human-in-the-loop pause → approve → resume (Slack / Teams / PagerDuty)
• Behavioral anomaly & reputation scoring
• A full audit log of every decision

---

Try it in one command

No account, no Docker, no config — the real engine runs on your machine:

npx -y lelu-mcp start

Give Claude Code guardrails right now:

claude mcp add lelu -- npx -y lelu-mcp start --transport stdio --preset coding-agent

Your agent gets a lelu_agent_authorize tool using the coding-agent preset: editing files, running tests and local git are allowed; package installs, pushes, deploys and anything touching secrets or env files go to human review; destructive actions are denied; everything else is default-denied. Rules live in ~/.lelu/policy.coding-agent.yaml (omit --preset for the general starter policy in ~/.lelu/policy.yaml). Cursor / Claude Desktop setup and full docs → sdk/mcp

Claude Code plugin — no tool-calling required

The MCP server above gives your agent a tool it can choose to call. The Claude Code plugin goes further: it hooks directly into every Bash, Edit, and Write call via Claude Code's own PreToolUse hook, so protection doesn't depend on the agent remembering to ask.

git clone https://github.com/lelu-ai/lelu.git && cd lelu
claude plugin marketplace add ./
claude plugin install lelu@lelu
./plugin-claude-code/install.sh

Expansion-aware — rm -rf ~/, rm -rf $HOME, and reversed/separated/long-form flag variants are all caught, where a regex on the raw command text catches 7/10 and false-positives on 4/4 benign commands — plus retry-storm detection and a session budget for runaway unattended sessions. Shadow mode by default, nothing blocks until you ask it to. Full docs → plugin-claude-code

The plugin stores its ledger, mode, socket, and daemon log in $HOME/.lelu/claude-plugin by default. Set LELU_DATA_DIR to use another directory; LELU_HOME is also accepted as a compatibility alias when LELU_DATA_DIR is not set.

---

Quickstart (SDK)

npm install lelu-agent-auth          # TypeScript — or: pip install lelu-agent-auth-sdk

import { lelu } from "lelu-agent-auth";

// Zero-config: discovers the engine `npx lelu-mcp start` runs on this
// machine (URL + key live in ~/.lelu) — no account, nothing to configure.
// Self-hosted or cloud instead? lelu({ baseUrl, apiKey }).
const auth = lelu();

const decision = await auth.authorize({
  tool: "delete_record",
  context: { confidence: 0.82, actingFor: "user_42" },
});

if (decision.decision === "allow") {
  await deleteRecord(id);
} else if (decision.decision === "human_review") {
  await notifyReviewer(decision.requestId); // agent pauses, human approves, resumes
} else if (decision.decision === "compute") {
  await saferAlternative(decision.safeTool, decision.safeArgs); // redirected to sandbox
} else {
  throw new Error(decision.reason); // denied
}

Four outcomes. Every decision audited. No other changes to how you build. Works with OpenAI, Anthropic, LangChain, LangGraph, CrewAI, Strands Agents, Vercel AI SDK, and MCP.

---

How it works

Every action flows through a layered pipeline — the strictest outcome wins:

• Prompt-injection filter — 5 layers: exact → homoglyph → fuzzy → structural → entropy
• Confidence gate — verified LLM token log-probs¹ — low confidence → deny or downgrade
• Policy evaluator — YAML roles + OPA/Rego, deny-first, wildcard patterns
• Risk model — criticality × (1 − confidence) × reliability × anomaly_factor
• Human-review queue — uncertain decisions pause for approval (Slack / Teams / PagerDuty)
• Behavioral analytics — shadow-agent detection, reputation scoring, baseline drift alerts

¹ Read from the provider (OpenAI, some Bedrock families) — never self-reported by the agent. No signal available (e.g. Anthropic Claude)? The engine applies its MissingSignalMode policy instead of trusting a fabricated score.

Also in the box: stable agent identity with RS256 workload JWTs and MCP OAuth 2.1 · AES-256-GCM OAuth token vault with 8 auto-refresh providers · NHI inventory with OWASP top-10 checks (/v1/nhi/inventory).

Stack: Go engine · Next.js dashboard · SQLite (local) / Postgres (prod) · Redis (optional)

---

Examples

• quickstart — the real engine on SQLite: one request per outcome, live prompt-injection catch
• langchain — gate a plain LangChain StructuredTool before execution
• crewai — gate CrewAI tool calls; a prompt-injected refund agent gets stopped
• strands — register as a Strands intervention handler; denials, safe-tool redirects and human approval all use Strands' own actions
• bedrock — gate Amazon Bedrock agents on the model's own verified confidence
• agentgateway — Lelu as the decision brain behind agentgateway (ext-authz PEP)

SDKs: TypeScript · Python · Go · MCP server

Self-hosting: npx -y lelu-mcp start runs the real engine with no build step, or build it yourself from source — go build ./cmd/engine or docker build -f engine/Dockerfile . — full options in examples/quickstart.

---

FAQ

Is it really free?

Yes — the engine, SDKs, MCP server, and dashboard are MIT licensed. Self-host everything with npx -y lelu-mcp start, or build the engine yourself from source. The hosted sandbox at lelu-ai.com is just a convenience.

Can't the agent just lie about its confidence?

No. Production engines only accept verified confidence signals — token log-probs read from the LLM provider, never a number the agent self-reports. When no verified signal exists, the engine applies its MissingSignalMode policy instead of trusting a fabricated score.

Does this replace OPA / Casbin / my IAM?

No — it sits on top. Lelu evaluates OPA/Rego and YAML policies as one step of its pipeline, then adds what those tools can't see: prompt-injection detection, confidence gating, behavioral anomaly scoring, and a human-review queue.

What happens when a decision is human_review?

The agent pauses, a reviewer gets pinged (Slack / Teams / PagerDuty), and the action resumes or dies with their verdict. Every decision — including the human's — lands in the audit log.

---

Contributing

Contributions of every size are welcome — from a typo fix to a new framework integration. Most wanted right now: 🔌 framework integrations (OpenAI Agents SDK, LlamaIndex, AutoGen), 📜 Rego policy templates (SOC 2, HIPAA, GDPR), and 📚 examples.

Pick up a good first issue, grab a help wanted task, or start a thread in Discussions. Setup and guidelines → CONTRIBUTING.md

If Lelu is useful to you, a ⭐ star helps more people find it — and tells us to keep going.

---

MIT © Lelu