Squidbrake

Each person and each AI agent gets its own key. Viewers can look at everything and change nothing; approvers also approve held actions and can stop agents; admins manage the team and settings; owners also decide who is an admin or owner. Agents can only ask permission and report what they did. Roles such as finance let rules require a specific team to approve.

Setting this up for a team? Tell us about your team and we'll help with rules, approvers and rolling it out, or book 15 minutes with the founder.

Also sent every Monday to Slack, Teams or email when they're set up in Settings.

Set in rules.yaml under budgets:. Claude Code reports its tokens by itself; other agents send them to POST /v1/usage.

Each computer's squidbrake doctor says which agents it has. Anything marked not connected works without Squidbrake: nothing it does is checked or recorded.

Choose which agents go through Squidbrake. Turning one off takes Squidbrake out of that agent only; the others stay as they are. Quit and reopen the agent afterwards so it picks the change up.

When an agent needs approval, the gateway can ping you on your phone and in Slack. Each message has a secure one-tap link to approve or reject that one action; the link stops working once it's decided.

Register your phone or laptop as a passkey. Each approval you make with it is signed by the device and kept in the audit trail as proof of who approved what; anyone with an export can check the signature.

A short, plain-English risk note on each action waiting for a person, written with your team's own Anthropic key. It only advises: the rules decide what's held and people decide what runs. What it reads is what this dashboard shows (redacted, previews capped); with no key, nothing is sent anywhere.

Every decision, as it happens: who, which tool, allowed, held or blocked and why, who approved. In batches, in the background, so a slow SIEM never slows an agent.

Agents copy what they read: a ticket's customer ends up in a pull request description or a public issue. When an agent puts text where others can read it (a PR, an issue or comment, a gist, a chat post) and it names a customer on this list, it waits for a person. Card numbers, social security numbers, IBANs and lists of people's emails or phone numbers are held there too, with no list needed.

ChatGPT and claude.ai connectors, Devin, n8n and other cloud agents use MCP servers by URL. Add the app's MCP server here and give the agent its Squidbrake URL instead: every call is checked like any other and recorded as the agent that made it.

The agent signs in with one of its keys (Team, add an AI agent): Authorization: Bearer gw_…. If the app only takes a URL, add ?key=gw_… to it, and treat that URL like a password.

What agents may do is decided by rules.yaml on the gateway: allow, block, or hold for a person (optionally a specific role). Edits apply within seconds. Use Test a rule to check what would happen.

Starter packs

Rules for a kind of agent, added to your rules.yaml after the read rule, so blocks above still win. A backup is kept.

Test a rule