faramesh-core

A Go daemon that sits in front of agent tool calls, reads permissions from a governance file, and permits, defers, or denies each call before it runs.

Faramesh applies governance as code to AI agents. Permissions get declared in a governance file, and a local daemon permits, defers, or denies each tool call before it executes. The README emphasizes two properties: no SDK lock in and no cloud required. Decisions are recorded in a write ahead log with a hash chain, which keeps the audit trail tamper evident.

The safety model rests on the daemon being the single enforcement point. Every tool call goes through it, so there is no SDK call to forget to wrap. Decisions are pure functions over the policy and the action payload, with no LLM in the decision path. Identity can be bound through SPIFFE SVIDs, OIDC, or cloud workload identity, and credentials are brokered at the call site rather than stored in prompts. Optional KMS signing covers the hash chained log.

Integration targets the agent stack a team already runs. The README lists LangGraph, LangChain, CrewAI, OpenAI Agents, Claude Agents SDK, Claude Code, Cursor, MCP, AutoGen, AG2, LlamaIndex, Pydantic AI, Bedrock, and Semantic Kernel, counting 13 frameworks. The hookup happens through an SDK shim, an MCP proxy, an HTTP proxy, or A2A, so the tier can match the agent.

A short policy example shows the intent: external emails go to a human, cancellations require a click, deletion is impossible without editing the policy, and a daily spend ceiling exists, with every decision landing in a verifiable log. The README also positions Faramesh against larger platforms, describing it as narrower than full stack agent platforms and outside the model output evaluation layer of products like Galileo Agent Control. Community channels include Slack, GitHub Discussions, and a contributing guide for policy packs and framework adapters.

• Source 1 · Project repository
• Source 2 · README