{
  "markdown": "<p align=\"center\">\n  <img src=\"docs/assets/runeward-banner-v2.png\" alt=\"runeward — the agent governance harness\" width=\"760\" />\n</p>\n\n<p align=\"center\">\n  <b>The open-source governance harness for AI agents.</b>\n</p>\n\n<p align=\"center\">\n  <a href=\"LICENSE\"><img alt=\"License: Apache-2.0\" src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\"></a>\n  <a href=\"https://github.com/Runewardd/runeward/actions/workflows/ci.yml\"><img alt=\"CI\" src=\"https://github.com/Runewardd/runeward/actions/workflows/ci.yml/badge.svg\"></a>\n  <a href=\"go.mod\"><img alt=\"Go 1.26.6\" src=\"https://img.shields.io/badge/go-1.26.6-00ADD8.svg\"></a>\n  <a href=\"https://github.com/Runewardd/runeward/releases\"><img alt=\"Release\" src=\"https://img.shields.io/github/v/release/Runewardd/runeward?sort=semver\"></a>\n</p>\n\nPut enforceable policy, human approvals, isolated execution, budgets, and signed evidence around\nany AI agent. Runeward works with an existing agent or multi-agent framework rather than requiring\na new model or orchestration stack.\n\n<p align=\"center\">\n  <img src=\"docs/assets/runeward-proof.svg\" alt=\"An agent action flows through policy and optional human approval into an isolated sandbox and signed audit trail\" width=\"820\" />\n</p>\n\n## Prove it in one command\n\nPrerequisites: a running Docker/Podman engine and the `runeward` binary.\n\n```bash\nruneward quickstart\n```\n\nThe command creates `.runeward/quickstart.toml`, checks the policy, runtime, image, and state path,\nruns an allowed command, proves a destructive command is denied before execution, and verifies the\nsigned audit trail. It never overwrites an existing policy unless `--force` is passed.\n\n`doctor` and dashboard readiness also resolve required secret sources. A Charter that references an\nunset `env://` value is not presented as launch-ready.\n\n```bash\nruneward doctor quickstart                     # explain setup problems safely\nruneward --config-dir .runeward serve          # dashboard + governed REST API\nruneward evidence export quickstart -o run.json\nruneward evidence verify run.json              # independent policy/audit verification\n```\n\n## What Runeward adds\n\n| Concern | Container alone | Runeward |\n| --- | --- | --- |\n| Tool calls | Executes what the process requests | Checks every shell, code, file, network, and browser action first |\n| Risky actions | Application-specific | `allow`, `deny`, or `require-approval` with an attributed decision |\n| Network | Usually open unless separately configured | Deny-by-default hostname policy; strict L3 enforcement on Kubernetes |\n| Limits | CPU/memory | Wall-clock, exec, egress, token, cost, and retry-loop budgets |\n| Audit | Runtime logs | Append-only, hash-chained, Ed25519-signed events |\n| Handoff | Ad-hoc logs and folders | Workspace tar, recovery snapshots, and portable signed evidence JSON |\n| Agent identity | One opaque process | Tenant, actor, parent run, provider, model, and durable run lineage |\n| Interfaces | Runtime-specific | CLI, REST, MCP, web dashboard, Kubernetes CRDs, and local SDK adapters |\n\nEvery governed action follows one path:\n\n```text\nagent request → policy → human approval when required → limits → sandbox → signed audit event\n```\n\n## Naming\n\nDocumentation and UI use familiar terms first. Existing API paths and file fields retain the\noriginal themed names for compatibility.\n\n| Plain-language term | Runeward name | Existing surface |\n| --- | --- | --- |\n| Sandbox | Citadel | `/v1/citadels`, Kubernetes `Citadel` |\n| Policy file/profile | Charter | `/v1/charters`, `*.toml` profile |\n| Approvals | Conclave | `/v1/conclave` |\n| Signed audit trail | Chronicle | `/v1/chronicle`, `[chronicle]` |\n| Network controls | Perimeter | `/perimeter`, `[network]` |\n| Budgets and limits | Rationing | `[rationing]` |\n| Agent group/fleet | Cohort | `/v1/cohorts`, `[cohort]` |\n\nSee the full [naming and writing convention](docs/naming.md).\n\n## Install\n\nChoose the package that matches how you use Runeward:\n\n| Install with | What it installs | Command |\n| --- | --- | --- |\n| [Homebrew](https://github.com/Runewardd/homebrew-tap) | Runeward CLI for macOS or Linux | `brew install Runewardd/tap/runeward` |\n| [PyPI](https://pypi.org/project/runeward/) | Python client and agent-framework adapters | `python -m pip install runeward` |\n| [npm](https://www.npmjs.com/package/@runeward/sdk) | TypeScript client and agent-framework tools | `npm install @runeward/sdk` |\n\nFor normal local use, install the CLI with Homebrew. For an agent integration, install the SDK for\nits language as well. The pip and npm packages connect to a running Runeward API; they do not\nreplace the CLI/runtime.\n\n### Homebrew — CLI\n\nLocal sandboxes require a running Docker, OrbStack, or Podman engine.\n\n```bash\nbrew install Runewardd/tap/runeward\nruneward version\nruneward quickstart\n```\n\n### pip — Python SDK\n\nRequires Python 3.9 or newer. The base client has no third-party runtime dependencies.\n\n```bash\npython -m pip install runeward\npython -c \"import runeward; print(runeward.__version__)\"\n```\n\n### npm — TypeScript SDK\n\nRequires Node.js 18 or newer.\n\n```bash\nnpm install @runeward/sdk\nnpm ls @runeward/sdk\n```\n\nSee [Adapters](docs/adapters.md) for LangChain, CrewAI, LlamaIndex, OpenAI Agents, Strands,\nVercel AI SDK, and LangChain.js installation options.\n\n### Other CLI installation options\n\nThe signed macOS/Linux installer requires\n[`cosign`](https://docs.sigstore.dev/cosign/system_config/installation/) so it can fail closed while\nverifying the checksum manifest. Windows binaries are available from\n[Releases](https://github.com/Runewardd/runeward/releases).\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/Runewardd/runeward/main/install.sh | sh\n```\n\nTo build the current `main` branch, use Go **1.26.6**:\n\n```bash\ngit clone https://github.com/Runewardd/runeward\ncd runeward\ngo build -o bin/runeward ./cmd/runeward\n./bin/runeward version\n```\n\n## Use it with an agent\n\nExpose governed tools to an MCP-capable IDE or agent:\n\n```json\n{\n  \"mcpServers\": {\n    \"runeward\": {\n      \"command\": \"runeward\",\n      \"args\": [\"mcp\", \"--config-dir\", \".runeward\"]\n    }\n  }\n}\n```\n\nOr place an agent CLI inside a sandbox and run one or many governed workers:\n\n```bash\nruneward cohort --agent claude --model sonnet build \"Build a tested API\"\n```\n\nAdapters are included for LangChain, CrewAI, LlamaIndex, OpenAI Agents, Strands, Vercel AI SDK,\nand LangChain.js. See [Adapters](docs/adapters.md) and [agent groups](docs/fleets.md).\n\nThe dashboard also has a read-only **Live chat** TTY for each Citadel. Agent harnesses publish\n`user`, `assistant`, `tool`, and `system` turns with `runeward_publish_conversation` (or the REST,\nPython, and TypeScript equivalents), and authorized teammates can follow the redacted conversation\nwithout terminal input access. Runeward cannot infer private UI chat text that the agent client does\nnot publish; wire the publish call into the harness turn callback. The publisher must connect to the\nsame `runeward serve` control plane as the dashboard (through `/mcp`, REST, or an SDK).\n\n## Harness agents and subagents\n\nRuneward is the enforcement boundary around an agent, not the component that decides how the agent\nreasons. Route the tool calls of a parent agent and each delegated subagent through Runeward to give\nthem explicit policy, approval, isolation, budget, and evidence boundaries.\n\nExisting concepts keep their meaning: a **Cohort** is a group of peer workers sharing a task board;\nit is not being renamed to “subagents.” The orchestrator still decides when to delegate, while\nRuneward records the parent/run/provider lineage and prevents a child Citadel from widening its\nparent's tenant or Charter. Every participating agent can receive its own Citadel and Chronicle.\nSee [Agent harnessing](docs/agent-harness.md).\n\n## Policy workflow\n\nPolicies support built-in glob rules, CEL, OPA/Rego, and signed OCI bundles. Test them in CI, start\nfrom a reviewed scaffold, or derive exact proposals from verified production evidence:\n\n```bash\nruneward policy scaffold package-approval\nruneward policy test quickstart --case 'tool=shell,action=rm -rf /,expect=deny'\nruneward policy learn run.json > proposed-policy.toml\n```\n\n`policy learn` never edits a policy automatically. It verifies the evidence first, skips redacted\nactions, produces exact matches, and requires a human to review and broaden them.\n\n## Security posture\n\n- The server binds to loopback by default and requires authentication before a non-loopback bind.\n- Non-loopback HTTP also requires TLS unless `--allow-insecure-http` explicitly acknowledges that a\n  trusted reverse proxy terminates TLS.\n- Multi-principal RBAC scopes sandboxes, agent groups, recovery snapshots, and dashboard views to\n  their tenant while attributing every operation to its actor. Static tokens and OIDC JWTs use the\n  same authorization model, and embedded HTTP MCP shares the REST ownership checks.\n- Browser automation is experimental and disabled by default. Enable it only in a trusted deployment\n  with `RUNEWARD_ENABLE_EXPERIMENTAL_BROWSER=1` after reviewing the [security model](docs/security-model.md).\n  Browser-capable Charters declare `capabilities = [\"browser\"]`; the dashboard then exposes governed\n  rendered-text and screenshot actions and their policy/egress results.\n- An optional browser IDE (code-server in-cell + ticketed reverse proxy) is similarly experimental:\n  `RUNEWARD_ENABLE_EXPERIMENTAL_IDE=1`, Charter `[ide]`, `Dockerfile.ide` targets\n  `ide` / `ide-agents`, examples `ide-demo` / `ide-claude` / `ide-codex` / `ide-cursor`.\n  Limits: not per-keystroke policy; no Cursor/Claude Desktop/Codex GUIs in-cell; no\n  first-class GitHub Copilot on code-server. See [Browser IDE](docs/browser-ide.md) and the\n  [security model](docs/security-model.md).\n- Per-action policy applies to tool calls routed through the control plane (REST, MCP, dashboard\n  file/shell/code actions, and SDKs). An interactive terminal or a process already running inside a\n  sandbox is a direct sandbox session: it receives isolation/network/resource controls and terminal\n  recording, but its individual commands are not intercepted for approval. Use governed tool calls\n  when command-level policy and signed verdicts are required.\n- Report vulnerabilities privately using [SECURITY.md](SECURITY.md). Runeward remains pre-1.0;\n  residual limitations are tracked in [ROADMAP.md](ROADMAP.md).\n\n## Documentation\n\n- [Quickstart](docs/quickstart.md)\n- [Policies / Charters](docs/profiles.md)\n- [REST API](docs/rest-api.md)\n- [Browser IDE](docs/browser-ide.md) (experimental code-server proxy)\n- [Security model](docs/security-model.md)\n- [End-to-end testing](docs/E2E-TESTING.md)\n- Published site: [runewardd.github.io/runeward](https://runewardd.github.io/runeward/)\n\nContributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md). Licensed under\n[Apache 2.0](LICENSE).\n",
  "bytes": 10880,
  "sha": "b5d040d5003f07230dad902b3c8d8aad9c702e225f62601b92f1f269889b7aa1",
  "repo_slug": "runewardd/runeward",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_runewardd_runeward_5f3d2967/readme"
}