Guardrails for agents that act.

Point kimji at your environment and it understands the risk surface, recommends guardrails, then detects and blocks risky agent actions in real time, holding the ambiguous ones for a human.

Request a demo See how it works

From your repo to a governed agent, in five steps

→

kimji sits between your agent and everything it touches

Every MCP tool call and CLI command routes through the control plane for a verdict before it executes. Nothing reaches an MCP server or your shell without one.

Your AI agent

Wants to act

mcp: github.create_pr

mcp: slack.send_message

cli: psql -c "DROP TABLE …"

→

every call

kimji control plane

Intercepts the call, matches policies, and asks the LLM judge when needed, then returns a verdict.

ALLOW ASK DENY

→

allow only

MCP servers

GitHub · Slack · Postgres · your internal tools. The call is forwarded and runs.

CLI / shell

psql · aws · kubectl. The command executes in your environment.

ask holds the call for human approval; deny means it never reaches the server or the shell.

Detect + block

Every tool call gets a verdict before it runs

Deterministic policies short-circuit the obvious cases; a hardened LLM judge reasons about the rest. Explicit fail modes: no judge, no silent allow.

Agent action

send_email(to, attaches_table)

sql_query · export_table · issue_refund · update_user_role …

→

Step 1 · Deterministic

Policy engine

Matches enabled guardrails. A hit short-circuits with a verdict and reason.

→

no match

Step 2 · Reasoning

LLM judge

Hardened judge with a forced risk-report tool call. Unavailable? Fails closed to ask.

→

ALLOW action runs

ASK held for human approval

DENY blocked, reason logged

Understand

It reads your actual code, not a questionnaire

kimji scans your repo, including SQL migrations, client code, and .env.example, and classifies the real risk surface. Then it recommends the guardrails to close it, one click to enable.

$ kimji understand ./your-agent-repo

{{ t.example }}

Guardrails

Recommended from the scan, or author your own

Full CRUD over policies. Each one is tunable, with thresholds, allow-lists, and protected tables, and toggles on or off without a deploy.