Developer Edition · Free & open source · Apache-2.0
Govern an AI agent in five minutes.
Watchlight Developer Edition runs the real Agent Runtime Governance engine in-process, so you can add a deterministic PERMIT / DENY to your agent’s tool calls on your own laptop. One install, zero infrastructure, the same API as production.
The code you write here is the code you run in production. Going live is pointing the same code at the control plane, not a rewrite.
$ pip install wat
That DENY line, in your own terminal, in under five minutes, with no account, is the product.
One install. Zero infrastructure.
Decorate the tools an agent can call and Watchlight puts a policy decision point in front of every one of them. Allowed calls run; anything without a matching policy is blocked before it executes, and recorded to a local, value-free audit trail.
- Runs the real, compiled engine in-process: no server, no database, no signup
- Deterministic decisions, with no language model anywhere in the authorization path
- Python and TypeScript, with the same three-state Allow / Deny / NeedsApproval verdict
- Free for production and commercial use, up to 25 governed agents per organization
pip install watchlight # Python
npm install @watchlight/sdk # TypeScript / Nodefrom watchlight import govern
govern.load("watchlight.policy.json")
@govern.tool(intent="research")
def web_search(query: str) -> str:
... # runs only if policy permits itDelegated authority
Govern the authority behind every action, not just the call
A per-tool-call check asks whether an agent may call a tool. Watchlight governs the delegated authority behind it. When an agent hands work to a sub-agent, the child receives a strict subset of the parent’s authority, and the engine refuses to widen it. Authority can only narrow as it propagates.
- Every sub-agent scope is a real, engine-validated strict subset of its parent
- A sub-agent can never widen its authority: the engine denies it before the action runs
- The full delegation tree is recorded, so you can prove who was allowed to do what, and why
root · orchestrator
researcher · depth 1⊆ parent
reader · depth 2 ⊆ parent
✗ widen researcher
AttenuationDenied: ['AllowedTools'] — 1 tool(s) not in parent.allowed_tools (e.g. ["delete"])
DELEGATION_DEPTH_EXCEEDED: delegation depth 6 exceeds max_delegation_depth 5
Already using a framework? Govern it in-process.
Bring an existing agent under governance with zero infrastructure, using the same plugin you ship to production. Going live is one environment variable, not a rewrite.
LangGraph
watchlight[langgraph]
Pydantic AI
watchlight[pydantic-ai]
Claude Agent SDK
watchlight[claude-agent]
MCP servers
watchlight-mcp
TypeScript / Node
@watchlight/sdk
Any custom app
watchlight-agent-sdk
pip install 'watchlight[langgraph]' # or [pydantic-ai], [claude-agent]
from watchlight.langgraph import governed_plugin
plugin = governed_plugin("watchlight.policy.json") # zero infra
# production = the SAME code, one env var:
# WATCHLIGHT_APDP_URL=https://... → authorizes against the control planeWatch every decision live
A zero-dependency local dashboard tails your value-free audit trail and shows every governance decision as it happens, including the DENYs that stopped a tool before it ran. Run watchlight dev and open 127.0.0.1:7000.
Total
0
Allowed
0
Denied
0
Agents
0
| Intent | Resource | Decision | ||
|---|---|---|---|---|
Unit-test policy before it gates real actions
A policy is the only thing between an agent and a real action, so test it like code. Assert the expected verdict for each case and run it in CI. The engine decides; the test holds zero decision logic.
Model Context Protocol
Put a policy enforcement point in front of any MCP server
The MCP PEP authorizes every governed call — tools/call, resources/read, and more — in-process, before it reaches the server, so a denied call never executes. Point your MCP client at the PEP instead of the server.
You don’t have to trust a black box to trust the decisions
Everything you integrate with is open and Apache-2.0. The decision engine ships as a compiled wheel, free for production up to 25 governed agents per organization.
The real engine, in-process
Developer Edition runs the same compiled authorization engine as production, on your laptop. No server, no database, no signup. Fail-closed semantics, strict-subset attenuation, and value-free audit are identical in every mode.
Open policy, open integration
Decisions use a standard, open, formally-specified policy language: the same policy yields the same decision, deterministically. The SDK, plugins, CLI, and MCP transport are Apache-2.0, readable, and forkable.
Every decision on disk
Each ALLOW and DENY is appended, value-free, to .watchlight/audit.jsonl, so you can inspect the engine’s behaviour on your own machine, tool by tool, before it ever gates a real action.
Same code, from laptop to fleet
Everything the Developer Edition removes is infrastructure, never a guarantee. When the fleet needs more, point the identical code at the enterprise control plane.
Developer Edition
Free & open source
- Real in-process engine, deterministic decisions
- Sub-agent strict-subset scope attenuation
- Local, greppable, value-free JSONL audit
- watchlight dev dashboard on localhost
Watchlight AI Beacon
Enterprise control plane
- Signed, tamper-evident, fleet-wide execution lineage
- Drift and anomaly detection with automatic quarantine
- Real-time effects: stop, quarantine, sever, revoke
- Attested identity: federated OIDC and workload mTLS
Only how strongly the principal is proven changes between them. The policies you write do not.
Ship a governed agent today.
Install it, decorate a tool, and watch the first DENY land in your own terminal. When you are ready for the fleet, the same code graduates to the enterprise control plane.
pip install watchlight · npm install @watchlight/sdk
Governing a fleet? Talk to us about Enterprise