Lelu MCP
An authorization engine for agents: every action gets allow, deny, human_review or compute, with each decision logged
- 75 ★ on the repository
- Last commit
Extended access
Why this level
- The engine decides which agent actions run, and a policy mistake can let a dangerous command through
- Manual review sends action descriptions to Slack, Teams or PagerDuty
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/leluDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The engine decides which agent actions run, and a policy mistake can let a dangerous command through
- Manual review sends action descriptions to Slack, Teams or PagerDuty
This is third-party code. Review the repository files before installing.
What it does
Lelu is an open source authorization engine under the MIT license that checks an agent action before it runs and returns one of four decisions: `allow` lets it run, `deny` blocks with a reason, `human_review` pauses the agent until a human approves and `compute` redirects to a safer alternative or a sandbox. Every decision is written to an audit log and the engine runs on your machine. The check layers run in a chain and the strictest outcome wins: a five-layer prompt injection filter, a confidence gate on model token log-probs, policies in YAML and OPA/Rego, a risk model, a human review queue with Slack, Teams and PagerDuty notifications and behavioral analytics. `npx -y lelu-mcp start` starts the local engine with no account or Docker. For Claude Code there is `claude mcp add lelu -- npx -y lelu-mcp start --transport stdio --preset coding-agent`: file edits, tests and local git are allowed, package installs, pushes, deploys and secrets go to human review and destructive actions are denied. The Claude Code plugin runs in shadow mode by default and blocks nothing until you turn blocking on.
Who it is for. Agent developers and security teams who need admission rules, manual approval and a log for agent actions.
Good fit when
- A Claude Code agent runs commands and the dangerous ones must go to manual review
- A support agent can issue a refund and amounts above a threshold need a human decision
- You need a decision log for every tool call to investigate incidents
- You want a shadow mode pilot: first see what the engine would have blocked
Not a fit when
- You need a single file permission: the agent's own access settings are enough
- You cannot run Node.js or the engine on your machine: it runs locally or on your infrastructure
- You need protection from a user with physical access to the machine: Lelu governs agent actions and does not protect against the person at the keyboard
Example request
Connect Lelu with the coding-agent preset and show which of my commands from yesterday would have gone to manual reviewMCP
- Transport
- stdio, http
- Authentication
- not required
Limitations
The confidence gate uses token log-probs that the provider returns: OpenAI and some Bedrock models have them and Claude does not, in which case the `MissingSignalMode` policy applies and no fabricated score is used. The Claude Code plugin is in shadow mode by default, so nothing blocks until you turn it on. Manual review needs configured Slack, Teams or PagerDuty channels. For production the author uses Postgres, while SQLite is enough locally. The plugin ledger and socket live in `$HOME/.lelu/claude-plugin`.
How to disable. Run `claude mcp remove lelu` for the server and `claude plugin uninstall lelu@lelu` for the plugin, then stop the `lelu-mcp` process. Data lives in `~/.lelu` and the directory can be deleted.
FAQ
Which decisions does Lelu return?
Four: `allow`, `deny` with a reason, `human_review` that pauses until approval and `compute` that redirects to a safer alternative or a sandbox.
What does the coding-agent preset do?
It allows file edits, tests and local git. Package installs, pushes, deploys and anything touching secrets or env files go to manual review, destructive actions are denied and everything else is denied by default.
Do I need an account or Docker?
No, `npx -y lelu-mcp start` runs the real engine on your machine with no sign-up, Docker or configuration.
Does the plugin block right away?
No, the Claude Code plugin starts in shadow mode: it records decisions and blocks nothing until you turn blocking on.
Is there an SDK?
Yes, `npm install lelu-agent-auth` for TypeScript and `pip install lelu-agent-auth-sdk` for Python. A single `authorize` call returns the decision.
Discussion
No questions or reviews yet.
Related
MCP serversA local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
A policy engine for AI agent actions: a Claude Code hook scores each call before it runs, then allows, blocks or waits for you
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Lelu (this card) | no | not required | 75 | |
| HOL Guard | yes | 1,094 | checks agent commands, secret reads and MCP calls and waits for your decision | |
| AgentGuard | no | 493 | checks actions before they run and scans third-party skills |
README in short
The README defines Lelu as an authorization engine between an agent and the outside world, explains how it differs from OPA, Casbin and AWS AVP and gives a one-command start. The Claude Code plugin, SDKs, the check pipeline and examples for LangChain and others follow.