Phinq

What is Phinq?

Phinq is an open-source, MIT-licensed runtime governance layer that sits between an autonomous AI agent and the systems it acts on: it classifies every proposed tool call by risk, lets reversible actions through, holds irreversible ones for human approval, and seals each decision into a tamper-evident audit log. It is aimed at developers running agents that already hold write access to production systems, credentials or external accounts.

Key features

• Deterministic classifier assigns each action one of five classes — RISK_REDUCING, REVERSIBLE, IRREVERSIBLE_LOW, IRREVERSIBLE_MEDIUM, IRREVERSIBLE_HIGH — and returns an ALLOW or HOLD decision with structural triggers explaining why
• Three integration paths: a proxy that observes OpenAI-style, Anthropic Messages and Gemini traffic, an MCP wrapper, and a TypeScript SDK that gates tool calls in process
• Held actions are resolved from the CLI (phinq holds / phinq approve / phinq deny) or through configured Telegram and Slack approval channels
• Silence is not treated as consent: an unresolved hold auto-denies after a default 240-second window
• Every decision is appended to a tamper-evident hash-chained audit log written as phinq-audit.jsonl
• Policy is configurable in phinq.yaml, with optional session-velocity and token-budget checkpoints that can add a hold
• Ships in shadow mode by default — it classifies and logs without enforcing holds until PHINQ_ENFORCE=1 is set, so you can observe your agent's real risk profile before blocking anything
• Documented integrations for MCP, Claude Code, Codex, OpenAI-compatible endpoints, Anthropic and Gemini; the site lists compatibility with LangChain, LangGraph, CrewAI, AutoGen, Mastra, Vercel AI SDK, Pydantic AI, LlamaIndex and Haystack

Who it's for

• Solo builders running an unattended agent with credentials to a production database, cloud account or billing system, who want an approval gate without adopting an enterprise governance platform
• Developers who want to observe what their agent actually attempts before restricting it, using shadow mode as a log-only audit run
• Teams running outbound agents (email, messaging, API writes) that need a human confirmation step before anything reaches a real recipient
• Anyone who needs an after-the-fact record of what an agent did and which actions were approved or denied, for incident review
• Agent developers on MCP, Claude Code or Codex who want a gate that does not require rewriting the agent or switching framework

When not to use it

Phinq is not a security boundary. By its own documentation, governance applies only to traffic routed through the proxy, MCP wrapper or SDK gate — an agent that shells out or calls an API by another path is entirely ungoverned; unknown tools are flagged rather than denied by default; localhost gate endpoints are open unless PHINQ_GATE_TOKEN is set; the hash-chained audit log cannot by itself detect a full rewrite or tail truncation without an external head anchor, and the separate tool-call corpus is not hash-chained and may contain raw arguments. It also does nothing until you set PHINQ_ENFOR

FAQ