CtrlAI

CtrlAI slots between your agent SDK and the LLM provider without touching your agent. You change one base URL, and the proxy forwards requests upstream, inspects the response, and returns it as if nothing happened. The SDK never knows. No rewrite, no wrapper, no new API to learn.

Rules live in a YAML file and match on tool name, agent ID, file path globs, command regex, URL regex, or any substring in the arguments. You can block a specific tool entirely, block it for one agent only, or block dangerous shell patterns like an rm -rf on the root. Multiple conditions in a rule are ANDed. Lists within a field are ORed. The first match wins.

Out of the box, CtrlAI ships with built-in rules covering SSH private keys, env files, credential files, shell config writes, destructive commands, data exfiltration, camera access, screen recording, location, and remote code execution. They're on by default. They're toggleable. You get baseline protection before you write a single custom rule.

You can terminate any agent instantly with ctrlai kill main --reason "suspicious activity", or stop everything with ctrlai kill --all. The proxy returns a fake end-of-turn response so the agent's loop stops cleanly. Kill state is written to a file and watched for hot reload. It takes effect within seconds even while the proxy runs.

Every tool call is recorded with a sequence number, timestamp, agent ID, tool name, arguments, decision, and the rule that matched. Each entry carries a SHA-256 hash linked to the previous one. Alter any entry, and the chain breaks from that point on. You can tail it live, query by agent or decision, verify integrity, and export to CSV or JSON.

A web dashboard on the same port shows agents, request and block counts, the full rule list, and a real-time feed of tool call decisions over WebSocket. Everything the dashboard shows is also reachable through a REST API, so you can script rule changes, kills, and audit pulls from your own tooling.

When one response contains several tool calls, CtrlAI evaluates each one but strips the entire response if any single call is blocked. The reasoning is that models plan calls as a group, so letting the "safe" half run could cause unpredictable behavior. It's the cautious default, with a partial-blocking mode noted as a future option.

Agent identity comes from the URL path, so /provider/anthropic/agent/work/... and /provider/anthropic/agent/main/... are treated as entirely separate agents, each with its own rules, audit history, and kill state. You can lock down one agent's permissions without changing what the others are allowed to do.