AgentHippo
Runtime governance for AI agents
The agent control plane,
enforced at the data layer.
A leaked record. A surprise bill. An agent nobody can stop. An incident nobody can explain. AgentHippo prevents all four — in your environment, enforced by the same infrastructure you already trust, not a proxy.
base_url = "https://gov.you.com/v1" No rewrites, no migration — governance wraps the agents you already have. Start with cost control →
› Four questions. Enforced answers.
"What's running — and who approved it?"
Every deployment reports to one console. An unknown agent can enroll itself — but it's born disabled until an admin approves it. Shadow agents surface instead of running unseen.
"Can we stop or roll it back?"
Yes — one agent, one user, or the whole fleet, in under a minute. Versions are pinned; rollback is one command. A network outage can't disarm your stop order.
"What can it touch?"
Only what this user, through this agent, is allowed to. Enforced by your database — Postgres RLS, AWS IAM, Unity Catalog — not the prompt. The agent holds no credential to steal.
"What did it do?"
Who asked, which signed version ran, what it touched, what it cost — a tamper-evident record in your storage, exportable in minutes. Content stays hashed unless you opt in.
› This is running in production right now
This lease governs a live agent on another host, over the public internet — right now. It's signed, and it expires every five minutes.
{
"pack": "agenthippo-emoji-first", // which signed agent may run
"version": "0.1.0", // pinned; rollback = re-pin
"enabled": true, // the kill switch
"caps": { "maxTurnsPerSession": 100 },
"requireSignedPack": true,
"requireSignedLease": true,
"billUsers": true, // spend attributes per user
"exp": <now + 300s> // stale lease ⇒ agent refuses work
}
Flip enabled to false in the console and that agent stops within a minute. Every claim
on this page maps to a check that runs at deploy time — in deployment scripts you can read.
› A control plane over a runtime, not a proxy
Most control planes are gateways: a shared credential plus a policy filter. Behind the filter, one account can still read every row.
Policy in a proxy
- Gateway holds the shared credential
- Policy filters requests in middleware
- Bypassed gateway = full exposure
- Spend and identity asserted from headers
- Runs as vendor SaaS in the middle
AgentHippo
- Agent never holds a durable credential
- Authority enforced by your database (RLS, IAM, Unity Catalog)
- Bypassed layer = a 401, not a breach
- Spend and identity ride signed, short-lived warrants
- Runs in your environment; governance plane hosted or self-hosted
MCP-compatible, credential model fixed: our connector is an MCP server — it just swaps a per-turn token for the requesting user's own authority instead of serving everyone from one shared credential.
› No black-box installs
Everything arrives as a versioned artifact your team can review and pin: what you approved is what runs, and nothing updates itself. Roll forward — or back — on your schedule, not ours.
The stack, as containers private registry · access with your plan
Open source on npm inspect the evidence pipeline yourself
Deployment scripts you can read
Every supported topology — single VM, your VM with our hosted plane, Cloud Run, Databricks — deploys from plain scripts your team can review before running. Each deploy checks itself and isn't done until every check passes.
› Go deeper
Start with cost control
Hard spend limits, per-person attribution, and an off switch for the agents you already run. Adopt in an afternoon.
Start with permissions
Replace the shared service account: agents act as the requesting user, enforced by your database.
Evidence & compliance
Hash-chained records, WORM archive in your storage, content hashed unless you opt in — an auditor-ready export in minutes, not a forensic project.
See the controls fail the right way.
Our demo shows an unauthorized user refused, a runaway agent stopped at its cap, a kill switch landing, and a full session reconstructed.