SpotAgentIQ

Your agent can send the email. You decide whether it should.

SpotAgentIQ is an open-source MCP proxy that sits between your AI agent and the tools it calls. Reads go straight through. Emails, refunds and deletes wait for a person. Card numbers never leave. Every call lands in an audit log that shows if anyone touched it afterwards.

Read the quickstart Cloud early access
go install github.com/spotagentiq/spotagentiq/cmd/spotagentiq@latest

Or download a binary. One file, no dependencies, Apache-2.0. Works with Claude Desktop, Claude Code, Cursor and any MCP client.

support-bot
  1. crm/get_customer {"id":"cus_8812"}Allowed
  2. crm/search_orders {"status":"open"}Allowed
  3. stripe/create_charge {"card":"4242 4242 4242 4242"}DeniedLooks like a card number
  4. email/send_email {"to":"dana@northwind.io"}HeldOutbound communication
  5. crm/delete_customer {"id":"cus_8812"}HeldDestructive
  6. email/send_emailApprovedby priya, from Slack

Four calls from one support ticket

This is the built-in demo. A support agent gets a billing complaint and has a tool server that can look up customers, charge cards, send email and delete records. Here is what it tries, and what SpotAgentIQ does about each call.

spotagentiq demo runs it on your machine in about a minute.

  1. crm/get_customer

    It looks the customer up.

    No rule mentions reads, so the default applies and the call goes straight through. The agent never notices SpotAgentIQ is there.

    Allowed
  2. crm/charge_card

    It tries to charge the card number from the ticket.

    A rule matches anything that looks like a 13 to 19 digit card number in the arguments, whatever the tool. The agent gets a readable refusal it can explain to the customer, not a crash.

    Denied
  3. crm/send_email

    It drafts an apology and tries to send it.

    Outbound email needs a person. The call waits in the inbox (and in Slack, if you set a webhook) with the full, redacted arguments. You read the draft, approve it, and the agent gets the real result.

    Held
  4. crm/delete_record

    It decides to "clean up" by deleting the record.

    Destructive calls are held too. You reject this one with a note. The agent is told no, and why, and says so to the customer.

    Rejected

The whole policy is shorter than this section.

Rules are read top to bottom and the first match wins. Tool names are matched with globs, and a rule can also test the arguments with a regex. There's no DSL to learn and no dashboard you have to click through.

1{
2  "agent": "support-bot",
3  "default_action": "allow",
4  "upstreams": [
5    { "name": "crm", "command": "npx", "args": ["-y", "@acme/crm-mcp"] }
6  ],
7  "rules": [
8    { "match": "*", "action": "deny", "if_args_match": "\\b\\d{13,19}\\b",
9      "reason": "Looks like a card number" },
10    { "match": "send_*",   "action": "require_approval", "reason": "Outbound" },
11    { "match": "delete_*", "action": "require_approval", "reason": "Destructive" },
12    { "match": "stripe/*", "action": "require_approval", "reason": "Moves money" }
13  ],
14  "redact": ["password", "token", "ssn", "card_number"]
15}
Line 3
Anything no rule mentions goes through. Flip it to require_approval if you'd rather start locked down.
Lines 8–9
Checked first, against every tool. A card number in any argument is refused before the tool ever sees it.
Line 12
upstream/tool scopes a rule to one server. Everything Stripe does waits for a person.
Line 14
These keys are masked, at any depth, in the log, the inbox and Slack.

How rules match, with more examples

A log you can't quietly edit.

Every line in the audit log carries the SHA-256 hash of the line before it. Change one character, delete a line, or slip one in, and every hash after that point stops matching. spotagentiq verify tells you which entry was touched.

Try it: change who approved entry 4.

  1. #1call.allowedcrm/get_customer
    rule: get_*
    prev 0000000000hash 2c77b73f48
  2. #2call.deniedcrm/charge_card
    Argument looks like a card number
    prev 2c77b73f48hash 77f230999f
  3. #3call.pendingcrm/send_email
    Outbound customer communication
    prev 77f230999fhash 77732051ff
  4. #4call.approvedcrm/send_email
    prev 77732051ffhash 1795ae0328
  5. #5call.completedcrm/send_email
    sent, id msg_51c
    prev 1795ae0328hash 8509443259
$ spotagentiq verify --log audit.jsonl
OK: 5 entries, chain intact.

Running in about a minute

  1. Install it

    One static binary for Linux, macOS and Windows. Nothing else to install.

    go install github.com/spotagentiq/spotagentiq/cmd/spotagentiq@latest
spotagentiq init > spotagentiq.json

  2. List your MCP servers as upstreams

    Move them out of your client config and into spotagentiq.json. SpotAgentIQ launches them and exposes the same tools under the same names.

    "upstreams": [
  { "name": "crm",   "command": "npx", "args": ["-y", "@acme/crm-mcp"] },
  { "name": "email", "command": "npx", "args": ["-y", "@acme/email-mcp"] }
]

  3. Point your agent at SpotAgentIQ

    Claude Desktop, Claude Code and Cursor all use the same shape. Open localhost:8484 to see held calls.

    "mcpServers": {
  "spotagentiq": {
    "command": "spotagentiq",
    "args": ["serve", "--config", "spotagentiq.json"]
  }
}

Full quickstart

SpotAgentIQ Cloud is coming.

The open-source proxy is built for one team on one machine. Cloud is for when agents run in several places and more than one person needs to say yes.

  • Approve from anywhere. Slack buttons and a phone-friendly inbox, with who-can-approve-what per tool.
  • Real identities. SSO and roles instead of a shared token.
  • Retention you don't run. Logs kept and their hashes anchored externally, ready for an auditor.
  • Every agent in one view. Across machines, teams and environments.

Your tool traffic keeps flowing through the binary on your own network. Only approval requests and redacted log entries reach the cloud.

Get on the list

We're inviting people in small batches, starting with teams already running the proxy.

What should we send you?
Tell us about your setup (optional, helps us pick design partners)

We use your email only for what you tick above. Privacy.

Questions people ask first

What is SpotAgentIQ?

SpotAgentIQ is an open-source MCP proxy. It sits between an AI agent (Claude, Cursor, or your own) and the MCP servers it uses, checks every tool call against a policy you write, and either lets it through, holds it for a human to approve, or blocks it. Every decision is written to a hash-chained audit log.

Does my agent need to change?

No. The agent sees the same tools with the same names. You point its MCP config at SpotAgentIQ instead of at the tool servers, and SpotAgentIQ launches those servers itself.

What happens to the agent while a call waits for approval?

The call blocks until someone approves or rejects it, or until the approval timeout. If the client sent a progress token, SpotAgentIQ sends progress notifications every 15 seconds so the connection stays open and the agent can tell its user it is waiting.

How is the audit log tamper-evident?

Each log line stores the SHA-256 hash of the line before it. Editing, inserting or deleting any line breaks the chain from that point on, and spotagentiq verify reports the first broken entry.

Is it free?

Yes. The proxy, policy engine, audit log and approval inbox are Apache-2.0 and will stay that way. SpotAgentIQ Cloud, a hosted control plane for teams, is in development and has a waitlist.

Does SpotAgentIQ slow down tool calls?

An allowed call costs one policy evaluation and one fsynced log write, which is under a millisecond on ordinary disks.

Further reading