Give your AI agents a human off-switch.
Seal pauses risky agent actions behind a policy and a one-tap human approval — with a tamper-evident audit trail for every decision. One SDK call. Fail-closed by default.
- 01fail-closed by default
- 02tamper-evident audit
- 03one SDK call
Drops into any agent stack
to gate any agent action
state + audit commit atomically
edit or delete paths on the log
free approvals every month
Start on your own machine
The proxy, the policy engine and the hash-chained audit log are open source and run in-process — no account, no network, no card. You sign up when a second person needs to approve.
$ npx @seal-dev/mcp-proxy --config seal.config.ts
[@seal-dev/mcp-proxy] local mode, upstream payments, audit seal-audit.jsonl
────────────────────────────────────────
Approve tool call `create_refund`?
Arguments:
{
"amount": 4200
}
[a] approve [r] reject (anything else rejects)
> Every decision is appended to a hash-chained log you can verify offline with --verify. Edit one record and the chain breaks.
What a server adds
Local mode is one developer at one terminal, and it is complete for that. These need something local mode structurally does not have.
- A second person can approve — roles, teams, escalation
- Approvals reach Slack and email, not just the terminal
- Agents in CI, where nobody is sitting at a prompt
- An audit trail an auditor can read, export and verify
Switching is one added block in the same config. Nothing local gets switched off.
Three steps to a human in the loop
Wrap the call, a human decides, the verdict is enforced. Everything else in your agent stays exactly as it is.
Wrap the risky call
One line — gate.require() — around the action an agent shouldn't take alone. Everything else runs untouched.
await gate.require({
action: "payments.transfer",
policyKey: "payments.high_value",
payload: { amount, to },
});A human decides
The request routes to Slack (or the reviewer console) with full context: agent, policy, payload, confidence. Approve or reject in one tap.
The verdict is enforced
Approved → the call proceeds. Rejected or expired → it never runs. Unknown input → the safe verdict, always. Every step co-commits to an append-only audit chain.
Every action, on the record. No exceptions.
A state change and its audit event co-commit in one transaction — status without audit, or the reverse, is impossible. The log is append-only by construction and by database guard: hash-chained, verifiable, with no edit or delete path, ever.
What you'd rather not hand-roll
Fail-closed by design
An unknown, missing, or malformed input yields the safe verdict — require_approval or deny — never the permissive one. Evaluation of untrusted input never throws.
Tamper-evident audit
State change and audit event co-commit in one transaction. The log is append-only by construction and by database guard — hash-chained, verifiable, no edit path, ever.
Policy, not hardcoding
Decide what needs a human by action, amount, agent, or scope. Change the policy without redeploying the agent.
Human-in-the-loop where humans are
Approvals land in Slack, the reviewer console, or your webhook. Reviewers act in seconds with keyboard-first controls.
Multi-tenant from the first row
Every request, key, and audit event is org-scoped. Scoped API keys, custom reviewer roles, least-privilege by default.
Built for agents, treated as hostile
Payloads are bounded and schema-parsed at the border. No implicit coercion, no ReDoS, no trust in an id alone.
Answers, up front
Q1What is approval-as-an-API?+
A hosted human-in-the-loop gate for autonomous agents. Instead of building approval UIs, queues, and audit logs yourself, you wrap a risky action in one SDK call and Seal handles routing it to a human, enforcing the verdict, and recording a tamper-evident audit trail.
Q2How is this different from building it myself?+
The hard parts are the invariants: fail-closed evaluation of untrusted input, a state change and its audit event committing atomically, and an append-only hash-chained log that can't be edited. Seal ships those correct by construction, plus Slack routing, scoped keys, and a reviewer console.
Q3What happens if a request times out or the input is malformed?+
It fails closed. An expired, unknown, or malformed request resolves to the safe verdict — the action never runs. The permissive path is never the default.
Q4Which agent frameworks does it work with?+
Any of them. Seal is a plain SDK call, so it drops into LangChain, CrewAI, AutoGPT, n8n, custom loops, or raw API calls — anywhere your agent is about to do something irreversible.
Q5Is the audit trail really tamper-evident?+
Yes. Every decision writes an append-only, hash-chained audit event in the same transaction as the state change. There is no update or delete path on the log, enforced in application code and by a database guard. You can verify the chain integrity at any time.
Q6How fast can I add it?+
Minutes. Install the SDK, create a gate with your API key, and wrap one action in gate.require(). The first approval can be flowing through Slack in a single sitting.
Ship agents you can actually trust.
Start free with 500 approvals a month. No card. The first one can be flowing through Slack in a single sitting.