Zero-config local engine — no account needed

The authorization engine for AI agents.

Every action checked. Every decision logged. Humans in the loop when it matters — a permission system your agents can't talk their way around.

Get startedTry the sandbox
Agents built with LangChain, CrewAI, Claude Code (MCP), or plain REST call Lelu and receive allow, deny, human_review, or compute decisions — every decision written to the audit log
Prompt-injection filtering
Verified confidence gating
Human-in-the-loop approvals
MIT licensed · self-hostable
Inside a request

Legitimate requests pass. Attacks don't.

Watch a request travel from your agent through Lelu's policy, confidence, and injection checks — and see what happens when a prompt injection tries the same path.

Agent reads a customer record with authorized scope

support-agent → GET /v1/customers/42

ALLOWEDPolicy crud-read matched grant

Your agents

  • LangChain / CrewAI
  • MCP servers
  • Chatbots
  • Apps + scripts
lelu
Policy
Confidence
Injection Filter
Audit

External services

  • Databases
  • Email + Slack
  • Payments
  • SaaS APIs

tools + APIs

Humans

Approve risky actions in Slack

Event log

  1. 1Agent requests customer:read via SDK
  2. 2Policy check — crud-read grants read on customers
  3. 3Confidence 0.96 verified, above threshold
  4. 4Allowed — tool call executed against the API
  5. 5Decision written to audit log (tr_4d21b8)
How it works

Lelu checks, decides, and logs every agent action

One HTTP call replaces weeks of guardrail infrastructure. Works with every major agent framework.

01

Agent calls a tool

LangChain, CrewAI, MCP, or plain HTTP — the agent asks Lelu before acting.

POST /v1/agent/authorize

02

Identity & policy

The actor is resolved and the action is checked against your YAML or Rego policy.

actor: support-bot

03

Security filters

Prompt-injection screening, verified confidence gating, and behavioral anomaly scoring.

confidence: 0.92 ✓

04

Decision returned

allow, deny, human_review, or compute — one of four explicit outcomes, never a guess.

"allowed": false

05

Audit log written

Every decision is recorded with full context: who, what, why, and the trace ID.

trace_id: tr_7f3a9c

allowthe action runs
denyblocked, with a reason
human_reviewpauses for approval
computererouted to a sandbox
See it in action

Your agent asks. Lelu decides.

Run the real engine on your machine in one command — no account, no Docker, no config.

Terminal demo: npx -y lelu-mcp start launches the zero-config local engine, then a curl to /v1/agent/authorize asking to delete_all_records is denied by policy
npx -y lelu-mcp start
# → local engine ready — policy, key, and audit
#   trail live in ~/.lelu. No account needed.
Or try it in the live sandbox — no signup →
Integrations

Works with your stack

Agent frameworks, policy languages, identity standards, and observability tools.

Works with your stack

RegoOPACedarLangChainLangGraphCrewAIAutoGenVercel AI SDKMastraSemantic Kernel
OpenAIAnthropicMCPOAuth 2.0JWTSAMLPostgreSQLRedisDatadogSIEM

Ready to give your agents guardrails?

The local engine is free, open source, and starts in one command.

Get startedStar on GitHub