ActionProxy v0.1.0 — Developer Preview

ActionProxy Community v0.1.0

ActionProxy is an open-source approval gateway for AI-agent tool calls. It evaluates proposed calls against deterministic policy, allows or denies them, pauses selected calls for human approval, grants exact one-time execution authority, and records lifecycle evidence.

This is a source-only developer preview.

Try the local proof

On macOS with Node.js 22–24 (Node 24 recommended) and Docker Desktop:

./actionproxy

Choose Run the local approval lifecycle. The guided proof uses three deterministic mocks: an allowed docs search, an email proposal held for approval, and a denied destructive action. It connects no production system and sends no real email.

See the README for prerequisites, retained SQLite evidence, stop, reset, and the experimental ChatGPT journey.

Highlights

• Deterministic allow, deny, and human-approval lifecycle.
• Exact, expiring, one-time execution grants; approval receipts; execution-attempt evidence; and append-only, hash-chained audit verification.
• Local web console and guided Quickstart, with memory, SQLite, and Postgres storage adapters.
• JavaScript SDK, external-runner helper, bounded stdio MCP wrapper, and an experimental OAuth-protected Streamable HTTP /mcp adapter.
• ./actionproxy integrate --mode sdk|mcp|http --json for non-overwriting, credential-free starter integrations and proof checklists.
• Checked-in OpenAPI 3.1, policy JSON Schema, and MCP-wrapper JSON Schema contracts plus isolated consumer-conformance tests.
• An experimental Secure MCP Tunnel journey exposing only the three mock tools.
• An opt-in Google Workspace downstream-MCP reference in which the operator-owned third-party MCP process retains Google OAuth and provider execution.

See the changelog, Community capability boundary, and test-status evidence map.

Important boundaries

• @actionproxy/sdk-js@0.1.0 and @actionproxy/mcp-wrapper@0.1.0 are packable source-package candidates; neither package is published to npm. Use the reviewed source/local-tarball procedure in the adoption guide. This release publishes no npm package or container image.
• The live entitled ChatGPT tunnel walkthrough, live Google Workspace downstream-MCP walkthrough, and uninvolved-user usability walkthrough remain post-release validation. Those paths are experimental; this release makes no live interoperability or provider-effect claim.
• The standard /mcp surface is experimental and requires an operator-provided OAuth 2.1 authorization server for public deployment.
• ActionProxy ships no hosted service or native production SaaS connector. Real executors and their credentials remain operator-owned, and ActionProxy cannot govern capabilities that bypass its configured adapters.
• Unauthenticated mode is for deliberate loopback development only. Stored action and audit payloads can contain raw sensitive data, and the local audit hash chain is not externally anchored. This preview is not presented as a complete production authorization or compliance boundary. Review the security policy before exposing it beyond local evaluation.
• The optional OpenAI tunnel-client is installed only after explicit user intent from ActionProxy's checksum-pinned review; it is not included in this release or its SBOM. The reviewed upstream v0.0.10 binary is ad-hoc signed, not Apple Developer ID-signed or notarized, and ActionProxy does not bypass Gatekeeper.

v0.1.0 hardening note

Three CodeQL risks were accepted only for this exact developer-preview release: secret-derived text can appear in the public-candidate scanner's diagnostic output, and adversarially long trailing-slash inputs can cause excessive work in the SDK and MCP-wrapper base-URL normalizers. Treat scanner output as sensitive, and do not supply untrusted or oversized base URLs. Locally tested remediations are required in the first normal post-release sync before v0.1.1; this acceptance is not precedent.

Source integrity

Protected annotated tag v0.1.0 resolves to commit 1bc592f229350e6d7556a3717dccf510ed61296b. The tag is annotated but unsigned. PUBLIC_MANIFEST.json has SHA-256:

a5e534b3487c58a8226c2331fae2dde07639459a742b6b202904da5e922e7f40

Anonymous commit/tag ZIP and tar downloads were checked against that manifest and passed strict Community boundary, link, secret, layout, and executable-mode verification. The attached source ZIP and tar preserve those exact verified bytes. Use the attached manifest, CycloneDX SBOM, runtime-license inventory, sanitized release-evidence record, and SHA256SUMS as the durable evidence set.

The exact release commit's public security workflow completed all nine jobs, including public CodeQL analysis. All findings were reviewed and dispositioned; the three release-specific accepted risks are disclosed above.

The checked-in test-status page was frozen before the final owner-controlled public workflow, tag, archive, and Release steps. The attached release-evidence record documents those post-freeze gates without rewriting the protected source tag.