Systems we’ve built, and the pattern behind them.
We build for capability and safety at the same time: agents that do real work, and can’t do the wrong irreversible thing without a person saying yes.
LocalAgent, a private multi-agent runtime
A complete agent system that runs on one machine: a local model plans and drives real tools, hands the hard parts to a stronger model, and gates every risky action behind a human. Built end to end as our reference architecture.
Local model
Private and on-device. Plans, calls tools, self-corrects with anti-loop guards.
Tool layer (MCP)
Files, shell, search, web. Reads run free; state changes are gated.
Human gate
Every risky action waits for a one-tap approve or deny. Full audit trail on disk.
Model hand-off
Stuck work routes to a stronger agent that finishes it, on your approval.
A run in progress: reads happen automatically, but issuing a refund waits for a human. Try it live →
Off-the-shelf agents are impressive in a demo and dangerous in production. They send your data to a third-party API, they spin in circles on multi-step tasks, and when they do act, they can take an irreversible step, delete a file, move money, email a customer, with no one watching. For a lot of teams that rules agents out entirely.
LocalAgent keeps the model on the machine, so prompts and data never leave. A planner-executor loop drives a typed tool layer over the Model Context Protocol, with anti-loop detection so it escalates instead of grinding. Read-only tools run freely; anything that changes state, or reaches a stronger model, stops for an explicit human approve or deny. Every decision is written to an audit log.
Capable enough to do the work. Safe enough to let it.
This is the pattern we bring to client work: real tool use, private by default, and a human gate that’s a hard control rather than a hopeful line in a prompt. The same architecture adapts to your stack, your tools, and your definition of “risky.”
Gatekeeper
We open-sourced the core idea: a human-approval gate any MCP agent can call.
A human-approval gate for any MCP agent
Drop-in tool that makes the gate a call the agent can’t route around: before an irreversible action, a person clicks Approve or Deny. Deny-closed by design, if no human can be reached, the answer is Deny, never a silent yes. Native dialog, zero heavy dependencies.
Available for client builds →Why it matters
Most “human in the loop” is a sentence in a system prompt the model ignores under pressure. Gatekeeper makes it structural.
Watch an agent work, with a human gate.
An interactive demo: the agent runs a real workflow and pauses for your approval on every irreversible step. Try denying one.
Open the live demo →