Sqube Agent Control

Open-source infrastructure for controlling AI agent actions.

v0.1 is an experiment. SDK wrapping is bypassable. This is not a replacement for IAM, gateways, or security controls. It exists to learn whether execution-decision tooling has pull in real teams.

Sqube Execution Guard (v0.1) wraps a consequential action, deterministically decides ALLOW / BLOCK / REQUIRE_APPROVAL, optionally pauses for a human via CLI, and writes an append-only SQLite execution record.

Do not use messaging like “secure your agents,” “enterprise control plane,” or “prevent all unauthorized actions.”

Status

Experimental — API may change.

SDKs

All three implement the same v0.1 contract documented on GitHub Pages (source: website/docs/v0.1-spec.md).

Quick start (Python)

from sqube_agent_guard import ExecutionGuard, Decision


def policy(action, resource, agent_id, **ctx):
    if action == "delete_file":
        return Decision.REQUIRE_APPROVAL
    return Decision.ALLOW


guard = ExecutionGuard(policy=policy)


@guard.wrap_action(action="delete_file", resource=lambda path: f"file:{path}")
def delete_file(path):
    ...


delete_file("/tmp/example.txt")

Quick start (Node.js)

import { Decision, ExecutionGuard } from "sqube-agent-guard";

const guard = new ExecutionGuard({
  policy: (action) =>
    action === "delete_file" ? Decision.REQUIRE_APPROVAL : Decision.ALLOW,
});

const deleteFile = guard.wrapAction(
  { action: "delete_file", resource: (path: string) => `file:${path}` },
  (path: string) => { /* ... */ }
);

await deleteFile("/tmp/example.txt");

Quick start (Rust)

use sqube_agent_guard::{Decision, ExecutionGuard, WrapOptions};

let guard = ExecutionGuard::with_default_policy().with_ledger_path("sqube_ledger.sqlite3");

guard.wrap_action(
    WrapOptions {
        action: "delete_file".into(),
        resource: Some("file:/tmp/x".into()),
        agent_id: "default".into(),
    },
    || Ok(()),
    "path=/tmp/x",
    r#"{"path":"/tmp/x"}"#,
)?;

Decisions

ALLOW
BLOCK
REQUIRE_APPROVAL

Policies are application-defined callables. No LLM in the decision path for v0.1.

Installation

Python and Node.js (published registries):

pip install sqube-agent-guard
npm install sqube-agent-guard

Rust — crates.io is not published yet. Clone this repository and build from rust/:

git clone https://github.com/Sqube-Groups/sqube-agent-control.git
cd sqube-agent-control/rust
cargo build
cargo test

To depend on the crate from another Rust project before crates.io publish, use a path or git dependency in Cargo.toml (see rust/README.md).

Packaging and releases for Python and Node.js are wired via GitHub Actions on version tags (v*.*.*). Configure repository secrets: PYPI_API_TOKEN, NPM_TOKEN.

Optional LLM probes

v0.1 guard decisions are deterministic — no LLM in the policy path. For manual experiments only (not CI, not ExecutionGuard), see examples/nvidia_kimi_vision_probe.py and Optional LLM probes on the docs site.

pip install requests   # or: pip install -e ".[probes]"
export NVIDIA_API_KEY="your-key"
python examples/nvidia_kimi_vision_probe.py
python examples/nvidia_kimi_vision_probe.py --no-stream

Development

# Python
pip install -e ".[dev]"
pytest

# Node
cd nodejs && npm ci && npm test

# Rust
cd rust && cargo test

Documentation

CI runs on pull requests and pushes targeting main; GitHub Pages deploys only on pushes to main; PyPI/npm releases run only for v*.*.* tags whose commit is on main.

Published docs (Docusaurus) deploy to GitHub Pages on pushes to main (project site — path includes the repo name):

Do not link https://sqube-groups.github.io/docs/... — that is the org/user site root without the /sqube-agent-control/ prefix. Unless you configure a custom domain at the org root, docs live only under /sqube-agent-control/.

Maintainers: Enable GitHub Pages (GitHub Actions source), docs deploy behavior, and release tag commands — see website/docs/deploy-pages.md.

Run locally:

cd website && npm ci && npm start

Keep private notes outside the repo under docs_internal_never_commit/ (gitignored). Other common local-only folder names (docs-never-commit/, .local-docs/, **/never-commit/) are ignored as well.

Project structure

src/sqube_agent_guard/     # Python SDK
nodejs/              # TypeScript / npm SDK
rust/                # Rust crate
tests/               # Python tests
examples/            # Python examples
website/             # Docusaurus docs site (GitHub Pages)

Contributing

Contributions and feedback are welcome. For larger changes, open an issue first.

License

Copyright © 2026 Sqube Groups — Apache-2.0

Sqube