Public preview · v0.10.2

Agent Firewall + Flight Recorder for AI Agents

RuleOak places a deterministic authorization boundary immediately before a supported AI-agent or MCP tool action executes. It can allow, deny, require human approval, bind an allow decision to a one-time execution grant, and write redacted tamper-evident evidence.

Run the 60-second demo Inspect the source

Policy before actionApproval before executionEvidence after decision

Try it first

Safe local evaluation in one command

npx @ruleoak/cli@latest demo quickstart

The demo makes no destructive or external calls. It shows the three core outcomes and creates local evidence plus an offline HTML report.

Open the full quickstart

Protect a real boundary

Guard supported tool-call traffic without redesigning the agent

npx @ruleoak/cli@latest protect -- node agent.js

protect initializes a conservative local workspace when needed, recommends a policy pack, runs diagnostics, guards supported routed tool-call traffic, handles approvals and one-time grants, and records evidence. It does not inspect arbitrary internal behavior inside the child process.

Node.js SDK

Use createRuleOak(), guardTools(), and guardFunction() for functions explicitly routed through RuleOak.

MCP boundaries

Guard MCP JSON-RPC tools/call over stdio or use the Streamable HTTP gateway for supported requests and SSE responses.

Human approval

Use terminal, prompt, queue, or approval-provider flows. Persistent choices become reviewable suggestions rather than silently widening policy.

Evidence and grants

Use hash-chained evidence, signed checkpoints, verifiable bundles, expiring decision receipts, and atomic one-time grant consumption.

Visual guide for developers

Where the RuleOak boundary sits

Click to enlarge

Lifecycle

Normalize the action, classify risk, evaluate Policy v2, resolve approval if required, consume the execution grant, then record evidence.

Click to enlarge

Integration point

Wrap the supported tool-call boundary. Actions that bypass the SDK, CLI, gateway, or authorization API are outside RuleOak control.

Click to enlarge

Architecture

Policy, approval, receipt/grant handling, evidence, reports, protocol contracts, and guarded transports remain local-first and model-independent.

Public packages · 0.10.2

Three packages, released together

Package	License	Purpose
`@ruleoak/protocol`	MIT	Contracts, JSON Schemas, validators, fixtures, and TypeScript types.
`@ruleoak/core`	Apache-2.0	Authorization runtime, adapters, approvals, receipts/grants, and evidence.
`@ruleoak/cli`	Apache-2.0	Quickstart, process protection, MCP gateways, local API, policy, learning, approval, and audit workflows.

RuleOak consumer apps

OakWave and OakTune are preparing for Google Play

OakWave

Worldwide radio: Free + restrained visual ads + Lifetime Pro.

Product, privacy and purchase details

OakTune

Local music: Free Basic + restrained Android visual ads + Lifetime Pro + optional supporter purchases.

Product, privacy and purchase details

View consumer apps

Security boundary

Application-layer authorization, not operating-system containment

RuleOak is not an OS sandbox, EDR, anti-malware product, kernel reference monitor, universal MCP compatibility layer, or complete prompt-injection detector. Local evidence is tamper-evident, not tamper-proof against a privileged local actor replacing the store.

Read the security boundary See tested compatibility

From source

Develop and verify the release

git clone https://github.com/ruleoak/ruleoak.git
cd ruleoak
npm ci --ignore-scripts
npm run check:publish

RuleOak v0.10.2 is pre-1.0 public-preview software. Security-sensitive behavior and APIs may change between minor versions.