Limetry Central
Self-hosted · Action governance API

Stop irreversible agent side effects cold.

This node is the open-source Limetry control plane. Agents, MCP hosts, and the CLI call it to evaluate tool-call intents, return an outcome (allow, deny, or wait), and audit a scrubbed projection (minimal by default) — before an irreversible tool runs.

Browse API paths Wire Limetry in 5 minutes

Evaluate before execute

POST an ActionIntent. Get allow, deny, or wait — plus reasons and an HMAC receipt. Audit stores a scrubbed projection (minimal by default)—not the full intent.

Audit you can tail

Every evaluation and recorded outcome becomes a structured event for operators and CI.

Engineer surfaces

Same contract as @limetry/sdk, @limetry/cli, and @limetry/mcp.

Available paths

Bearer tokens need matching scopes. JWT routes use operator login.

Method / path Auth Purpose
GET / none This landing page
GET /health none Liveness JSON
GET /metrics bearer · metrics:read Process metrics snapshot
POST /v1/policy/evaluate bearer · policy:evaluate Evaluate ActionIntent (or legacy TransactionIntent)
POST /v1/actions/record bearer · actions:record Record executed / skipped / blocked outcome
GET /v1/audit bearer · audit:read List audit / telemetry events
GET /v1/policies bearer · policies:read List registered policies
PUT /v1/policies/:policyId bearer · policies:write Upsert ActionPolicy
GET /v1/approvals bearer · approvals:read List pending / resolved approvals
POST /v1/approvals/:approvalId/approve bearer · approvals:write Approve a pending action after payload-hash match
POST /v1/approvals/:approvalId/deny bearer · approvals:write Deny a pending action
POST /v1/auth/register none Create operator user + tenant
POST /v1/auth/login none JWT login (requires tenantId)
POST /v1/auth/logout JWT Revoke current JWT
GET /v1/profile JWT Current operator profile
POST / GET / DELETE /v1/tokens JWT Create, list, revoke API tokens
CRUD /v1/rules JWT or bearer · rules:* Governance rule management

Try evaluate

With the server running and LIMETRY_BEARER_TOKEN set, upsert a policy then evaluate a denied action: 

curl -s http://localhost:4801/health

curl -s -X PUT http://localhost:4801/v1/policies/$POLICY_ID \
  -H "Authorization: Bearer $LIMETRY_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"policy":{ ... ActionPolicy ... }}'

curl -s -X POST http://localhost:4801/v1/policy/evaluate \
  -H "Authorization: Bearer $LIMETRY_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"policy_id":"'"$POLICY_ID"'","intent":{ ... ActionIntent ... }}'