AI agents you can hand to an auditor.

AgentVisor AI is a small server you drop in front of your agent’s LLM and tool calls. Every request is recorded. Every limit you set is enforced before the call goes out. Every session ends with a signed receipt anyone can verify offline — without asking you or us for anything except a public key.

Try it in 60 seconds Read the code

v0.1.0 · Apache‑2.0 · Rust · Runs on your machine, your VM, or your cluster

Point your existing OpenAI client at it

One line of code. Zero SDK.

AgentVisor AI speaks OpenAI’s chat/completions and MCP over plain HTTP. Change the base URL your client points at. Nothing else in your app moves.

Works the same way for Anthropic-compatible clients, Ollama, LM Studio, Azure OpenAI, and anything else that speaks the same wire format. 

python
  from openai import OpenAI

  client = OpenAI(
      api_key=os.environ["OPENAI_API_KEY"],
+     base_url="http://127.0.0.1:8484/v1",
  )

  client.chat.completions.create(
      model="gpt-4o-mini",
      messages=[{"role": "user", "content": "hello"}],
  )

What you get

Three things you didn’t have before.

A signed record of every session

When the agent’s session finishes — whether that’s a single chat completion or a 40-step tool-using conversation — AgentVisor AI hands back a receipt like the one on the right. It commits to the full event chain, the cost, and how many tool calls were allowed vs blocked.

Verification is one avctl receipt-verify call with your public key. Or 30 lines of your language’s Ed25519 library. You don’t need to trust AgentVisor AI to trust the receipt. 

receipt.json
{
  "receipt_id": "01924f8b-1f0c-7c31…",
  "session_id": "sess-2024-08-14-42",
  "issued_at_iso": "2024-08-14T21:07:14Z",
  "subject": {
    "kind": "event_chain",
    "chain_head": "b2b7c9d8…",
    "event_count": 47
  },
  "tool_calls": {
    "total": 8, "allowed": 7, "blocked": 1
  },
  "cost": {
    "prompt_tokens": 12408,
    "completion_tokens": 3819,
    "cost_usd_micros": 84340
  },
  "stop_reason": "budget_exceeded",
  "key_id": "c8f2…",
  "signature_b64": "wg7A0Kx3…"
}

Hard limits, refused at the door

That blocked: 1 in the receipt was a tool call that would have blown past the session’s cost cap. Your agent received a plain HTTP 403 and moved on. The provider was never contacted; the money was never spent.

Set caps on total tool calls, per-tool calls, spend in micro-USD, and prompt tokens. Turn on the semantic loop breaker if your agent tends to retry the same failing thing until you go broke. 

POST /v1/mcp
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": {
    "code": -32001,
    "message": "tool call blocked by AgentVisor AI policy",
    "data": {
      "stage": "budget",
      "reason": "max_payout_usd_micros (cap 50000000)"
    }
  }
}

Evidence you can send anywhere

Every event is written as OCSF-shaped JSON — the same schema your SIEM already speaks. Every session that never finishes becomes an ATIF trajectory file compatible with the Harbor validator. Every artifact is just a file under data/.

Ship the files to S3, feed them into Vector, hand them to a customer’s evidence locker, or archive them for the seven years your industry demands. AgentVisor AI does not phone home. 

$ ls -R data/
data/
├─ receipts/
│   └─ 84a3….json         # signed session receipt
├─ sess-2024-08-14-42.json  # ATIF v1.7 trajectory
├─ outbox/
│   └─ 84a3….receipt.json # pending broker publish
└─ bridge/
    └─ topics/
        └─ agent.tool_call/
            └─ p0.jsonl         # OCSF event stream

See what’s happening

A dashboard for the agent you already deployed.

Every AgentVisor AI instance ships a small operator dashboard at /dashboard. Open it in a browser and you can see the sessions your agent is running right now: which prompts, how many tokens, how much money, which tools were called, which calls were blocked, and where the ones that failed got stuck.

It reads the same in‑memory state that produces receipts and /metrics. No extra service, no separate database, nothing to log into. Off by a config flag if you don’t want it.

  • Live session table with cost, tokens, tool calls, stop reason
  • Click a session to see its receipt as raw JSON, live
  • Filter by open, closed, or capture‑failed — and by workflow
  • No JavaScript framework, no phone‑home — served straight from the binary

When you’d want it

Three moments this pays for itself.

The 3 AM cost spike

Your agent gets stuck in a retry loop and burns $2,400 on a Sunday. AgentVisor AI’s loop breaker plus the payout cap would have cut it off at $10, logged what happened, and let your on-call sleep.

The compliance email

An auditor asks which customers’ data your agent touched last quarter. Instead of running a scavenger hunt through LangSmith and provider dashboards, you hand over a directory of receipts and a public key.

The customer question

A customer wants to know whether the agent you built for them called any model or tool other than the ones you promised. You give them a session receipt and 20 lines of verification code.

Get started

60 seconds, one prompt at a time.

Requires Rust, or a pre-built binary from the releases page. The wizard asks one thing at a time and writes the config file for you. When it finishes, AgentVisor AI is running on http://127.0.0.1:8484.

Point your OpenAI client at that URL as if it were the provider. No code changes beyond the one line above. 

$ cargo install av-harness av-cli
$ avctl

  1) OpenAI
  2) Anthropic
  3) Azure OpenAI
  4) Ollama (local)
  5) LM Studio (local)
  Pick a provider [1]: 1

  Paste your OpenAI API key: ••••••••••••••
  Key stored under ~/.agentvisor/keys/ (chmod 600).

  Start now? [Y/n]: y

  AgentVisor AI is running on http://127.0.0.1:8484
  Point any OpenAI-compatible SDK at it. Ctrl-C to stop.

Under the hood

Boring, on purpose.

AgentVisor AI is a Rust workspace of twelve crates. No hosted service, no phone-home telemetry, no vendored dashboard. It writes files. You keep the signing key.

Runs anywhere Rust runs

Single static binary or two-container compose (harness & Redpanda). Also ships a hardened Kubernetes manifest and a systemd unit with sensible defaults.

Pluggable backends

Event bus: embedded (files), Kafka / Redpanda, NATS JetStream. State: in-memory or Redis. Vector store: Qdrant or none. Pick what your org already runs.

Interoperable formats

Events are OCSF 1.10; trajectories are ATIF v1.7; receipts are Ed25519 over RFC 8785 canonical JSON. If you already have a SIEM or an evidence tool, it probably already reads these.

Actually audited

Every fix is regression-tested. The full suite runs on every code push; supply-chain policy is enforced by cargo‑deny. Read the security model before you deploy it — it’s honest about what it does and does not defend against.

Read more

Everything else.