Conduct open-sources fail-closed guardrails that police LLM and MCP tool calls before they run

A new open-source project named Conduct landed on Hacker News's front page with an ambitious pitch: runtime governance for AI agents, enforced before an agent acts rather than reported after the fact. The repository, published on GitHub under the name sseshachala and released under Apache 2.0, packages a policy engine, an LLM proxy, a chat interface and a library of compliance rules into a single deployable stack.

Two components, three chokepoints

According to the project's README, the core is split into Conduct Guard and Conduct Router. Guard is the policy engine: for every AI action it decides between block, warn, audit or inject before that action executes. Router is a proxy for LLM traffic — point an Anthropic, OpenAI or Perplexity SDK at it and each request is evaluated by Guard on its way to the upstream provider.

Enforcement fires at three chokepoints, the README says: a CLI hook that intercepts tool calls from coding assistants such as Claude Code, Cursor, Copilot and Codex; the MCP layer, covering every Model Context Protocol tool invocation; and the Router, covering SDK-based model calls. One policy applies across all three surfaces.

Cryptographic guardrails

Two design choices distinguish Conduct from a plain rules engine. First, signed configuration: each workspace signs its active policy set, and Guard verifies that signature before enforcing anything, so a tampered policy pack gets rejected no matter who pushed it or at which layer. Second, a tamper-evident audit log: every decision appends to a SHA-256 hash chain rooted when the workspace is created, and a one-click verification catches any missing or altered entry. The project also specifies fail-closed behavior as its default failure mode.

Governance, not observability

The project positions itself against what it calls runtime firewalls, naming Straiker and Lakera, which it characterizes as reporting agent behavior after it happens. Conduct's own comparison table claims pre-action timing, coverage of both LLM and shell or MCP calls rather than model calls alone, and fail-closed rather than fail-open defaults. These are the project's claims about competitors, not the result of an independent benchmark, so buyers should weigh them accordingly.

What ships in the repo

The repository includes more than 20 compliance packs covering OWASP, SOC 2 CC7.3, HIPAA §164.312, PCI DSS 4.0, EU AI Act Articles 15 and 16, NIST AI RMF and ISO 42001, alongside framework-specific packs for Python, Node and Terraform. Twenty-two pre-built playbooks — issue-to-PR, incident response, deploy gating and similar workflows — are each a single YAML file. A component called Ask Lens offers natural-language querying over governance data, and notably its own tool calls pass through the same Guard policy engine and audit trail as a live agent.

Deployment is a single docker compose command that brings up a FastAPI backend, Postgres, Redis and a Next.js canvas UI, with Guard and Router exposed at dedicated API paths. A pip-installable CLI syncs hooks and policies so that coding-assistant sessions on a machine fall under the same active rules. Kubernetes templates, a security policy, a threat model and an audit-log verification procedure are documented in the repository.

Discovery mode and the commercial layer

For teams not ready to enforce anything, Conduct offers a free 14-day Discovery mode: read-only visibility into every AI action a team takes, after which a rule can be promoted directly from observed activity. The hosted control plane at conductai.ai is a commercial product built on top of the open-source repository; the Apache license covers the code, including an explicit patent grant, while the Conduct trademarks remain with the company.

Why it matters

Agents increasingly execute real actions — shell commands, MCP tool calls, API requests — inside engineering environments, and most governance tooling today watches what already happened. Pre-execution enforcement with signed policies and verifiable audit trails mirrors the controls security teams already expect in adjacent domains, and the MCP focus arrives as the protocol becomes a standard integration path for agent tooling. Conduct is young, its competitive claims are self-reported, and its fail-closed defaults deserve independent testing before anyone trusts production traffic to the proxy. But the problem it targets — runtime control over autonomous tool use across every assistant an engineering team runs — is one that more organizations are hitting every month, and an Apache-licensed reference implementation moves the conversation from dashboards to enforcement.