lelu

Lelu

Authorization engine for AI agents.
Every action checked. Every decision logged. Humans in the loop when it matters.

Live Sandbox · One-Command Start · Examples · MCP Server · Contributing · Discussions

---

What is Lelu?

Lelu is an open-source authorization engine that sits between your AI agent and the real world. Before the agent takes any action — issuing a refund, sending an email, deleting a record — it asks Lelu first, and Lelu returns one of four decisions:

• ✅ allow — the action runs
• ⛔ deny — blocked, with a reason
• 🙋 human_review — the agent pauses until a human approve
• 🧪 compute — redirected to a safer alternative or sandbox

It's one HTTP call from any language or framework, every decision is written to an audit log, and the engine runs entirely on your own machine or infrastructure.

Why Lelu?

Give your agent a permission system it can't talk its way around.

Okta tells you who can do what. Lelu tells you when they're doing it wrong. Traditional auth tools (OPA, Casbin, AWS AVP) block unauthorized access — they can't detect when a legitimately authorized agent is being manipulated by prompt injection, acting on low confidence, or behaving anomalously. Lelu closes that gap.

	OPA / Casbin / AWS AVP	Lelu
Role & permission checks	✅	✅ YAML + Rego
Prompt-injection detection	❌	✅ 5-layer filter
LLM confidence gating (verified log-probs)	❌	✅
Human-in-the-loop pause → approve → resume	❌	✅ Slack / Teams / PagerDuty
Behavioral anomaly & reputation scoring	❌	✅
Audit log of every decision	partial	✅

A destructive agent action blocked by the default policy — try it live, no signup.

---

Try it in one command

No account, no Docker, no config — the real engine runs on your machine:

npx -y lelu-mcp start

Give Claude Code guardrails right now:

claude mcp add lelu -- npx -y lelu-mcp start --transport stdio

Your agent gets a lelu_agent_authorize tool: destructive actions denied, payments and outbound email routed to human review, production writes redirected to a sandbox, everything else default-denied. Rules live in ~/.lelu/policy.yaml. Cursor / Claude Desktop setup and full docs → sdk/mcp

---

Quickstart (SDK)