01 / Custos / Public implementation
An agent can call a tool.
Should it be allowed to?
Custos is my open-source work on runtime governance for MCP tool calls: evaluate a policy, gate execution, and retain inspectable evidence of the decision.
The problem
Capability needs a boundary.
An agent with tool access can act on real systems. The engineering problem is deciding which calls may execute, applying those decisions at the tool boundary, and retaining evidence that can be checked later.
Implementation
Policy, execution, evidence.
Evaluate the request
The native policy engine evaluates ordered rules against tool, actor, server and argument context. The first matching rule wins; the loader defaults to deny when no default is supplied. A hash identifies the policy source.
Integrate at the tool boundary
The repository provides an in-process SDK and an MCP stdio proxy. Its WebMCP adapter delegates to a caller-supplied decision function and handles allow, deny and approval outcomes, including cancellation. Policy and ledger operations belong in the backend.
Record a verifiable decision
The JavaScript ledger links records with SHA-256 hashes and signs them with Ed25519. Policy snapshots identify the rules in effect. Argument hashes keep raw inputs out of the normal audit record.
Trade-offs & limits
An audit trail is not the whole security boundary.
Signed records make alteration detectable. They do not establish that every possible tool invocation passed through Custos. Bypass prevention also requires scoped credentials, network boundaries and downstream verification.
Hashing arguments reduces disclosure, but prevents argument-level replay without a separately retained input log. The JavaScript ledger requires a single writer per file; concurrent writers across processes are unsafe.
The WebMCP adapter is deliberately thin: the application supplies backend authorization and approval handling. Production integration must own authentication, token freshness and operational policy.
Current maturity
Inspectable code. Explicit limits.
The public repository contains implementation, examples and tests. This portfolio review inspected source; it did not independently execute the Custos test suite or validate a production deployment. No enterprise adoption, security certification or production-readiness claim is made.