Authorization engine for AI agents.
Every action checked. Every decision logged. Humans in the loop when it matters.
Live Sandbox · One-Command Start · Examples · MCP Server · Contributing · Discussions
Lelu is an open-source authorization engine that sits between your AI agent and the real world. Before the agent takes any action — issuing a refund, sending an email, deleting a record — it asks Lelu first, and Lelu returns one of four decisions:
- ✅
allow— the action runs - ⛔
deny— blocked, with a reason - 🙋
human_review— the agent pauses until a human approve - 🧪
compute— redirected to a safer alternative or sandbox
It's one HTTP call from any language or framework, every decision is written to an audit log, and the engine runs entirely on your own machine or infrastructure.
Give your agent a permission system it can't talk its way around.
Okta tells you who can do what. Lelu tells you when they're doing it wrong. Traditional auth tools (OPA, Casbin, AWS AVP) block unauthorized access — they can't detect when a legitimately authorized agent is being manipulated by prompt injection, acting on low confidence, or behaving anomalously. Lelu closes that gap.
| OPA / Casbin / AWS AVP | Lelu | |
|---|---|---|
| Role & permission checks | ✅ | ✅ YAML + Rego |
| Prompt-injection detection | ❌ | ✅ 5-layer filter |
| LLM confidence gating (verified log-probs) | ❌ | ✅ |
| Human-in-the-loop pause → approve → resume | ❌ | ✅ Slack / Teams / PagerDuty |
| Behavioral anomaly & reputation scoring | ❌ | ✅ |
| Audit log of every decision | partial | ✅ |
A destructive agent action blocked by the default policy — try it live, no signup.
No account, no Docker, no config — the real engine runs on your machine:
npx -y lelu-mcp startGive Claude Code guardrails right now:
claude mcp add lelu -- npx -y lelu-mcp start --transport stdioYour agent gets a lelu_agent_authorize tool: destructive actions denied, payments and outbound email routed to human review, production writes redirected to a sandbox, everything else default-denied. Rules live in ~/.lelu/policy.yaml. Cursor / Claude Desktop setup and full docs → sdk/mcp
npm install lelu-agent-auth # TypeScript — or: pip install lelu-agent-auth-sdkimport { lelu } from "lelu-agent-auth";
// Zero-config: discovers the engine `npx lelu-mcp start` runs on this
// machine (URL + key live in ~/.lelu) — no account, nothing to configure.
// Self-hosted or cloud instead? lelu({ baseUrl, apiKey }).
const auth = lelu();
const decision = await auth.authorize({
tool: "delete_record",
context: { confidence: 0.82, actingFor: "user_42" },
});
if (decision.decision === "allow") {
await deleteRecord(id);
} else if (decision.decision === "human_review") {
await notifyReviewer(decision.requestId); // agent pauses, human approves, resumes
} else if (decision.decision === "compute") {
await saferAlternative(decision.safeTool, decision.safeArgs); // redirected to sandbox
} else {
throw new Error(decision.reason); // denied
}Four outcomes. Every decision audited. No other changes to how you build. Works with OpenAI, Anthropic, LangChain, LangGraph, CrewAI, Vercel AI SDK, and MCP.
Every action flows through a layered pipeline — the strictest outcome wins:
| Layer | What it does |
|---|---|
| Prompt-injection filter | 5 layers: exact → homoglyph → fuzzy → structural → entropy |
| Confidence gate | Verified LLM token log-probs¹ — low confidence → deny or downgrade |
| Policy evaluator | YAML roles + OPA/Rego, deny-first, wildcard patterns |
| Risk model | criticality × (1 − confidence) × reliability × anomaly_factor |
| Human-review queue | Uncertain decisions pause for approval (Slack / Teams / PagerDuty) |
| Behavioral analytics | Shadow-agent detection, reputation scoring, baseline drift alerts |
¹ Read from the provider (OpenAI, some Bedrock families) — never self-reported by the agent. No signal available (e.g. Anthropic Claude)? The engine applies its MissingSignalMode policy instead of trusting a fabricated score.
Also in the box: stable agent identity with RS256 workload JWTs and MCP OAuth 2.1 · AES-256-GCM OAuth token vault with 8 auto-refresh providers · NHI inventory with OWASP top-10 checks (/v1/nhi/inventory).
Stack: Go engine · Next.js dashboard · SQLite (local) / Postgres (prod) · Redis (optional)
| Example | What it shows |
|---|---|
| quickstart | The real engine on SQLite — one request per outcome, live prompt-injection catch |
| langchain | Gate a plain LangChain StructuredTool before execution |
| crewai | Gate CrewAI tool calls — a prompt-injected refund agent gets stopped |
| bedrock | Gate Amazon Bedrock agents on the model's own verified confidence |
| agentgateway | Lelu as the decision brain behind agentgateway (ext-authz PEP) |
SDKs: TypeScript · Python · Go · MCP server
Self-hosting: docker run -p 8080:8080 ghcr.io/lelu-ai/lelu/engine:latest — Helm chart in helm/, full options in examples/quickstart.
Is it really free?
Yes — the engine, SDKs, MCP server, and dashboard are MIT licensed. Self-host everything with npx -y lelu-mcp start or Docker. The hosted sandbox at lelu-ai.com is just a convenience.
Can't the agent just lie about its confidence?
No. Production engines only accept verified confidence signals — token log-probs read from the LLM provider, never a number the agent self-reports. When no verified signal exists, the engine applies its MissingSignalMode policy instead of trusting a fabricated score.
Does this replace OPA / Casbin / my IAM?
No — it sits on top. Lelu evaluates OPA/Rego and YAML policies as one step of its pipeline, then adds what those tools can't see: prompt-injection detection, confidence gating, behavioral anomaly scoring, and a human-review queue.
What happens when a decision is human_review?
The agent pauses, a reviewer gets pinged (Slack / Teams / PagerDuty), and the action resumes or dies with their verdict. Every decision — including the human's — lands in the audit log.
Contributions of every size are welcome — from a typo fix to a new framework integration. Most wanted right now: 🔌 framework integrations (LangChain, OpenAI Agents SDK, LlamaIndex), 📜 Rego policy templates (SOC 2, HIPAA, GDPR), and 📚 examples.
Pick up a good first issue, grab a help wanted task, or start a thread in Discussions. Setup and guidelines → CONTRIBUTING.md
If Lelu is useful to you, a ⭐ star helps more people find it — and tells us to keep going.
Thanks to these wonderful people (emoji key) — contributions of any kind are welcome:
 Abenezer Getachew 💻 📖 🚇 🚧 |
MIT © Lelu