For agents

If you’re an agent, start here.

Everything below is plain text: what MACAW is, how to install it, and which problem it solves. People are welcome too.

What MACAW is.

MACAW is deterministic controls for autonomous agents.

It checks identity, policy (MAPL) and approvals before each action runs, and keeps a signed record of what happened.

The decision depends on the call and the policy, not on the model, so it holds whatever model or guard is in the loop.

Copy and run. Free for individual developers.

The same plugin for Codex.

codex plugin marketplace add macawsecurity/macaw-plugin
codex plugin add macaw-cx@macaw

The MACAW runtime
Adds policy decisions, approvals and the signed record. Asks what to install, and where.
```
npm install -g macaw-ai && macaw-ai install
```
The client library
For your own agents and apps: identity, telemetry export and approval routing.
```
npm install -g @macaw-ai/client && macaw-client install
```

Building with OpenAI, Anthropic, LangChain, Pydantic AI, LiteLLM or MCP? Change one import: SecureAI adapters.

The MAPL skill turns one sentence into policy, functions and approvals, grounded in the open spec.

The MAPL skill · In the Claude Code and Codex plugins

“Trades over 5,000 need a manager. Each approval works once.”

"trade_approved::{params.amount > 5000}"
approval_criteria: role:manager · one_time: true

Installed with the plugin. In Claude Code: /macaw-cc:mapl followed by what you want. In Codex: ask for the mapl skill.

Find yours. Each one links to the product and the detail.

My coding agent ran a destructive command.: The coding agent sidecar works out what each command does before it runs. Policy denies it or holds it for a person.Coding agents
My agent can be prompt-injected through the data it reads.: Every tool call is checked against policy before it runs, whatever the model was told. On AgentDojo, none of the 184 attacks gpt-4o carried out on its own took effect through MACAW.Benchmarks
A person must approve payments or writes over a limit.: A conditional attestation holds the call above the limit and routes it to the right role. The approval is signed and single-use.MAPL attestations
I need to limit which models, and how many tokens, each person uses.: Policy constraints per company, team and person. Each level can only narrow the one above.Parameter constraints
PII must not appear in LLM replies.: A processor masks or withholds the result after the call, LLM replies included.The verification pipeline
I use a third-party MCP server I don’t control.: SecureMCPProxy sits in front of the server and checks every call. No change to the server.SecureMCP Store
I have to prove to an auditor what my agent did.: Every request, decision and approval is on a signed, hash-chained record you can verify.Platform
My support agent must follow our written policy.: State the policy in MAPL. Verifiers check each call against records the service itself signed.τ²-bench, in MAPL