Govern what your AI agents are allowed to do.

The API capability governance layer. Declare your API's capabilities in YAML. Enforce risk tiers, human approval, and a NIST AU-3 audit trail for every agent action.

No spam. No credit card. Just early access.

Why agent governance is broken today

MCP servers expose everything

A vendor MCP server hands your agent every endpoint in the API. Hundreds of tools, each one a token cost and an entry in the attack surface, with no way to say "these three, not those thirty".

Agents act anonymously

Most platforms treat an agent as an anonymous caller. No role, no grants, no idea which agent did what. A tool call is indistinguishable from a stranger holding a service token.

No audit trail for AI decisions

When an agent acts, you cannot answer which agent did this, on whose authority, or whether it was allowed. For anything a regulator touches, that is the whole question.

Declared capabilities. Risk tiers. Human approval.

Capability Explorer

Capabilities declared in an adapter, their risk tier, and the kernel's decision for an agent actor
Capability	Risk	Agent decision
get_ticket	low	allowedruns immediately
set_priority	medium	approval requiredqueued for a human
delete_ticket	high	agent forbiddenblocked for agents
rotate_api_key	low	not exposedagent_forbidden: true

Every call is recorded with actor, capability and outcome. NIST AU-3.

Every capability an agent can call is declared in YAML. Every call is classified by risk. Every action is recorded.

How it works

1
Declare API capabilities
One YAML file per integration. Each capability is a name, a method, a path, and a risk tier.
2
The kernel enforces
Every call is classified by risk. Low runs, medium queues for a human, high is refused.
3
Every call is recorded
Actor, capability, target, outcome and latency, in a NIST AU-3 shaped audit row.

The artifact you write

adapters/salesforce.yamldeclared, not discovered

name: salesforce
display_name: Salesforce Sales Cloud
base_url: https://api.salesforce.com/v60
auth:
  type: bearer
  header: Authorization
  source: credential_store

capabilities:
  - name: get_opportunity
    method: GET
    path: /sobjects/Opportunity/{id}
    description: Fetch one opportunity by id.
    risk: low
    approval_required: false
    agent_forbidden: false
    content_risk: medium

  - name: update_stage
    method: PATCH
    path: /sobjects/Opportunity/{id}
    description: Move an opportunity to a new stage. Revenue-affecting.
    risk: medium
    approval_required: true
    agent_forbidden: false
    content_risk: low

  - name: delete_opportunity
    method: DELETE
    path: /sobjects/Opportunity/{id}
    description: Permanently remove an opportunity.
    risk: high
    approval_required: true
    agent_forbidden: true
    content_risk: low

Built for platform teams running AI agents in production

Engineering leaders deploying agent infrastructure
Platform teams who need an audit trail for compliance
Security teams concerned about prompt injection
Companies building internal AI tools that touch customer data

The kernel is MIT and never gated. See thetest that proves it, or readthe concept.

Get early access to TCPcore