seshat govern what AI agents do on your machine

Your agent acts on your machine.
Now you decide what it's allowed to do.

Seshat sits between your agent and your system at the MCP tier. You write permissions in plain English — permit what it should do, forbid what it shouldn't. Every action, allowed or denied, gets a tamper-proof hash-chained receipt.

❯ brew install rmichaelthomas/seshat/seshatcopied ✓

Free · open source · Apache 2.0 · no account, no telemetry, no network calls

session agreement.limn
09:41start_project → my-apiALLOW
09:41receipt #7a3f chainedok
09:41write_file → src/app.pyALLOW
09:42set_secret → __API_KEY__DENY
09:42forbid: secrets stay manual—
09:43invariant: port-3000 listeningPASS
09:43chain verify → 142 ok, 0 breaks✓
demo
CLI loop Interactive TUI
seshat — CLI
agreements

Permission, before

Plain-English rules on actor, action, scope. Checked at the MCP tier before anything runs. A forbid always wins.

permit actor is "claude-code"
 and action is "start_project"
forbid action is "set_secret"

liminate-mcp — let your agent help draft them. pip install liminate-mcp

invariant

Correctness, after

A verification contract checks the environment after each permitted action. Deterministic. No LLM in the loop.

require port-3000 is "listening"
require tests is "passing"

liminate-invariant — the correction harness underneath. pip install liminate-invariant

receipts

Provenance, chained

SHA-256 hash-chained receipts in ~/.seshat/. Tamper with one and verify catches it. Sync to the cloud, or don't.

"action": "start_project"
"receipt_hash": "def456…"
"previous_hash": "abc123…"
one install, four surfaces
seshat
TUI
Interactive terminal session
seshat status
CLI
One-shot commands for scripts
seshat serve
Dashboard
Browser UI at localhost:9000
seshat mcp
MCP server
Agent integration via stdio
lifecycle
DEFINEwrite PROVEenforce CORRECTverify KEEPchain REVOKEsubtract AMENDnarrow
works with
Claude Code · Cursor · Windsurf Any MCP client · stdio transport macOS · Python 3.11+

Not a sandbox. Not a prompt wrapper. A governance layer with a receipt chain.

She measured the foundation before anything was built.

seshat 2.0.0 · Apache 2.0
Liminate · prose-as-syntax
GitHubPrivacyTerms

𓋇 Keyboard

Copy install commandenter
Open GitHub repog
Open docsd
Switch demo tabtab
This help?
Closeesc