CTRLRun is an open-source execution-safety layer for consequential AI-agent actions such as refunds, payments, deletes, emails, deployments, and other operations you do not want an agent executing incorrectly or twice.

Wrap a function with @protect and define a small YAML policy. CTRLRun then controls whether the action can execute.

It provides:

• Exact approval binding: approval for €2,000 cannot be reused for €5,000.

• Duplicate-effect protection: retries cannot blindly execute the same consequential effect twice.

• Ambiguous outcome handling: if the external action may have succeeded but the response was lost, CTRLRun treats it as AMBIGUOUS, not FAILED.

• Runtime policy enforcement: low-risk actions can execute automatically, higher-risk actions can require approval, and prohibited actions are denied.

• Execution receipts: every executed action leaves a record of what was authorized, what ran, and how it ended.

CTRLRun works with plain Python, LangGraph, OpenAI Agents SDK, and MCP servers through its gateway.

Try it locally:

pip install ctrlrun && ctrlrun demo

The demo runs five common agent-execution failure scenarios and shows how CTRLRun handles each one. It runs offline in under a second.

Core dependencies are intentionally small. State can use SQLite or PostgreSQL.

Apache-2.0 licensed.