Skip to content

The idea behind TCPcore

Every agent action is a promise. A promise to a customer, to a regulator, to your own audit trail.

Today, most agent frameworks treat that promise as implicit. The agent calls an API, and nothing records what it did, on whose authority, or whether it was allowed.

TCPcore makes the promise explicit.

Four primitives

1

The capability

A declared API operation with a name, a method, a path and a schema. The unit of what an agent can do.

get_ticket       GET    /tickets/{id}
set_priority     PATCH  /tickets/{id}
delete_ticket    DELETE /tickets/{id}
2

The risk tier, and two independent flags

Every capability carries one of three risk tiers, plus two booleans that are not tiers: approval_required forces the human queue, and agent_forbidden removes the capability from agent reach entirely.

risk: low              runs immediately
risk: medium           requires human approval
risk: high             blocked for agents

approval_required      forces the human queue
agent_forbidden        never exposed to agents
3

The identity

Every agent has a name, a role and a set of granted capabilities. The same model as human users, so one policy applies to both.

4

The audit trail

Every action is recorded with actor, capability, target, payload, outcome and latency, in a NIST AU-3 shape. Secrets in a payload are redacted before the row is written.

What TCPcore is not

Naming what a product is not is the fastest way to be believed about what it is.

Not an agent framework

It is not Devin, Codex or Cursor. Those are agents. TCPcore is the layer between an agent and the API it calls.

Not a sandbox

It is not Coder, Docker or Firecracker. Those govern where an agent runs. TCPcore governs what it does when it calls an API.

Not an MCP server

MCP is the protocol. TCPcore is the policy layer above it: which of the tools MCP exposes an agent is actually allowed to call.

Architecture

Every agent call passes through the kernel. The kernel decides, records, and forwards. There is no path around it.

  1. Agent"call get_ticket with id=T-1"

  2. TCPcore kernel

    1. identity
    2. → capability lookup
    3. → risk gate
    4. → approval queue, when required
    5. → governedCall
    6. → audit record + proxy
  3. Your API

The one thing we will never do

We will never gate the governance layer itself.

The risk gate, the approval queue, the audit trail, the prompt-injection sanitiser and the MCP surface are unconditional in every licence state. An expired licence, a Community install, a self-hosted instance with no key at all: all five still run.

This is not a marketing promise. It is a test, it runs in the public repository, and you can read it without asking us for anything.

Read the test

packages/kernel/src/__tests__/governance-never-gated.test.ts

Get early access

No spam. No credit card. Just early access.