Open-source MIT guardrail tracks audience×trust labels across tool calls (algebra, not LLM-as-judge), returns remedy plans (sanitize/authority/subagent) so agents keep ~90% task completion with 0% exfil on their benches—plugs via pre/post tool hooks; docs also as MCP.
MIT Python package signs every policy-gated tool call into a hash-chained .tkb file verifiable offline (Python+TS); works across Claude Code, OpenAI Agents, LangChain/LangGraph, MCP and more—agents can edit their own logs but not hide edits when the signer is out of reach.
Claustrum (alpha, .NET NativeAOT) is a harness-neutral conductor: an architect in Claude Code, Cursor, Copilot CLI, opencode, or desktop delegates builds/reviews/tests to agents on any other harness/model and gets one normalized JSON receipt. Two doors — `claustrum run` CLI and `claustrum mcp` stdio server. Parallel builders on git worktrees, budget ledger, backends doctor. Role-based routing (strong model for architect/reviewer, cheap for builders) without locking the pipeline to one vendor.
Enterprise GA for cg-oci, cg-apk, cg-versions, and cg-api so Claude Code/Cursor agents verify image tags, Wolfi package equivalents, EOL status, and org policy/attestations via browser OAuth or chainctl—server-side caps instead of prompt guardrails.
Agentic Reliability Center GA gives one metered telemetry+LLM door, shared operational memory, and human-in-the-loop policy gates; new MCP lets Claude Code/Cursor/Codex investigate incidents from the IDE while inheriting audit trails and approval gates.