Developer Edition · Free & open source · Apache-2.0

Govern an AI agent in five minutes.

Watchlight Developer Edition runs the real Agent Runtime Governance engine in-process, so you can add a deterministic PERMIT / DENY to your agent’s tool calls on your own laptop. One install, zero infrastructure, the same API as production.

The code you write here is the code you run in production. Going live is pointing the same code at the control plane, not a rewrite.

View on GitHub Read the docs

Running more than one agent? Watchlight Cloud connects your Developer Edition deployments to one control center.

your terminalpython

from watchlight import govern

@govern.tool(intent="research")
def web_search(query: str) -> str: ...

@govern.tool(intent="transfer")
def transfer_funds(to: str, amount: int) -> str: ...

$ python agent.pyoutput

watchlight: governing 'my-agent' (dev mode, in-process engine)
watchlight: ALLOW  read     tool/web_search
watchlight: DENY   execute  tool/transfer_funds   no matching policy

That DENY line, in your own terminal, in under five minutes, with no account, is the product.

Local · In-process · Developer control loop

Agent Runtime Governance you can experience before you deploy

Build

Governed agents, in your own code

Add a deterministic runtime authorization decision directly to your agent with a lightweight SDK and drop-in framework plugins. The code you write here is the code you run in production.

Govern

Every action, checked before it runs

Proposed tool calls are evaluated against policy before execution, using the same Agent Runtime Governance model as the enterprise control plane. A denied call never fires.

Inspect

See every PERMIT and DENY, locally

Watch decisions and value-free execution evidence stream to a local dashboard, and grep the audit trail on disk, without deploying any enterprise infrastructure.

One install. Zero infrastructure.

Decorate the tools an agent can call and Watchlight puts a policy decision point in front of every one of them. Allowed calls run; anything without a matching policy is blocked before it executes, and recorded to a local, value-free audit trail.

Runs the real, compiled engine in-process: no server, no database, no signup
Deterministic decisions, with no language model anywhere in the authorization path
Python and TypeScript, with the same three-state Allow / Deny / NeedsApproval verdict
Free for production and commercial use, up to 25 governed agents per organization

installbash

pip install watchlight        # Python
npm install @watchlight/sdk   # TypeScript / Node

govern a toolpython

from watchlight import govern

govern.load("watchlight.policy.json")

@govern.tool(intent="research")
def web_search(query: str) -> str:
    ...   # runs only if policy permits it

Delegated authority

Govern the authority behind every action, not just the call

A per-tool-call check asks whether an agent may call a tool. Watchlight governs the delegated authority behind it. When an agent hands work to a sub-agent, the child receives a strict subset of the parent’s authority, and the engine refuses to widen it. Authority can only narrow as it propagates.

Every sub-agent scope is a real, engine-validated strict subset of its parent
A sub-agent can never widen its authority: the engine denies it before the action runs
The full delegation tree is recorded, so you can prove who was allowed to do what, and why

attenuate authority to a sub-agentpython

from watchlight import AttenuationDenied, Watchlight

gov = Watchlight(agent="orchestrator")

# the human-delegated authority this agent holds
root = gov.scope(
    tools=["read_file", "web_search", "send_email", "delete"],
    intents=["research"],
)

# a sub-agent gets a STRICT SUBSET, never more
researcher = root.attenuate(tools=["read_file", "web_search"])
reader     = researcher.attenuate(tools=["read_file"])

# widening is refused by the engine, before anything runs
try:
    researcher.attenuate(tools=["read_file", "delete"])
except AttenuationDenied as denied:
    print("denied:", denied.violations)  # 'delete' not in parent authority

$ python examples/governed_subagents.pyoutput

root         : ['read_file', 'web_search', 'send_email', 'delete']
→ researcher : ['read_file', 'web_search']   (depth 1)
  → reader   : ['read_file']                 (depth 2)
  ✗ widen denied : ['delete'] not in parent authority

Already using a framework? Govern it in-process.

Bring an existing agent under governance with zero infrastructure, using the same plugin you ship to production. Going live is one environment variable, not a rewrite.

LangGraph

watchlight[langgraph]

Pydantic AI

watchlight[pydantic-ai]

Claude Agent SDK

watchlight[claude-agent]

MCP servers

watchlight-mcp

TypeScript / Node

@watchlight/sdk

Any custom app

watchlight-agent-sdk

same plugin, in-processpython

pip install 'watchlight[langgraph]'   # or [pydantic-ai], [claude-agent]

from watchlight.langgraph import governed_plugin
plugin = governed_plugin("watchlight.policy.json")   # zero infra

# production = the SAME code, one env var:
#   WATCHLIGHT_APDP_URL=https://...   → authorizes against the control plane

Watch every decision live

A zero-dependency local dashboard tails your value-free audit trail and shows every governance decision as it happens, including the DENYs that stopped a tool before it ran.

local dashboardbash

watchlight dev     # → http://127.0.0.1:7000

Unit-test policy before it gates real actions

A policy is the only thing between an agent and a real action, so test it like code. Assert the expected verdict for each case and run it in CI. The engine decides; the test holds zero decision logic.

policy tests in CIbash

watchlight policy test suite.json       # Python
npx watchlight policy test suite.json   # Node
#  Allow  ·  Deny  ·  NeedsApproval (human-in-the-loop)

Model Context Protocol

Put a policy enforcement point in front of any MCP server

The MCP PEP authorizes every governed call — tools/call, resources/read, and more — in-process, before it reaches the server, so a denied call never executes. Point your MCP client at the PEP instead of the server.

govern an MCP serverpython

pip install watchlight-mcp

import watchlight_mcp

watchlight_mcp.serve(
    listen_addr="127.0.0.1:9700",
    upstream_url="http://localhost:3000/mcp",
    policy_files=["mcp.policy.json"],
    audit_path=".watchlight/audit.jsonl",
)

You don’t have to trust a black box to trust the decisions

Everything you integrate with is open and Apache-2.0. The decision engine ships as a compiled wheel, free for production up to 25 governed agents per organization.

The real engine, in-process

Developer Edition runs the same compiled authorization engine as production, on your laptop. No server, no database, no signup. Fail-closed semantics, strict-subset attenuation, and value-free audit are identical in every mode.

Open policy, open integration

Decisions use a standard, open, formally-specified policy language: the same policy yields the same decision, deterministically. The SDK, plugins, CLI, and MCP transport are Apache-2.0, readable, and forkable.

Every decision on disk

Each ALLOW and DENY is appended, value-free, to .watchlight/audit.jsonl, so you can inspect the engine’s behaviour on your own machine, tool by tool, before it ever gates a real action.

Watchlight Cloud · Early access

Govern agents locally. Manage them centrally.

The local dashboard is enough for one agent on one laptop. Watchlight Cloud is the control center for the rest: it connects your Developer Edition deployments so a team can share one policy, one decision history, and one inventory. The authorization decision still runs in your process.

Central policy

Author, lint, and version policy bundles once, then distribute them to every environment instead of copying a file between machines.

Decision history

Allow, Deny, and NeedsApproval verdicts retained past the local session and searchable across your fleet, so a decision is still there tomorrow.

Agent inventory

Every governed agent, discovered from the audit trail it already writes. Nothing to register by hand.

Team access

Your team sees the same policy, the same decisions, and the same agents, rather than each developer holding a private view on a laptop.

Decisions stay local. Only the record travels.

Nothing sits between your agent and its tools. Watchlight Cloud is in early access.

Request early access

Same code, from laptop to fleet

Everything the Developer Edition removes is infrastructure, never a guarantee. Add a control center when the team needs one, and point the identical code at the enterprise control plane when the fleet does.

Developer Edition

Free & open source

Real in-process engine, deterministic decisions
Sub-agent strict-subset scope attenuation
Local, greppable, value-free JSONL audit
watchlight dev dashboard on localhost

Get it on GitHub

Watchlight Cloud

Early access

Everything in Developer Edition, decisions still local
Central policy bundles, versioned and distributed
Decision history that outlives the local session
Agent inventory and shared team access