⭐ Star the repositories you find useful and follow OpenLeash for new releases, plugins, and project updates.
| Repository | What it does |
|---|---|
🖥️ desktop-client |
Installed tray app, local API, and hook installer for connecting developer agents to OpenLeash. |
⚡ client-api |
Client-facing API for hooks, evaluation, enrollment, mobile approvals, and updates. |
🛡️ dashboard-api |
Admin API for organization setup, users, policy, plugins, audit, and usage. |
📊 dashboard-web |
Organization dashboard for identity, deployment, policies, plugins, and audit history. |
📱 mobile-client |
iOS and Android companion for reviewing and responding to approval requests. |
🔀 local-proxy |
Local AI-agent traffic proxy and policy-enforcement relay. |
🔄 provider-puller |
Scheduler that discovers and normalizes agent activity from hosted enterprise providers. |
🧱 shared |
Shared TypeScript contracts, event schemas, and plugin types used across OpenLeash. |
📚 docs-web |
Source for the public OpenLeash documentation site. |
| Repository | What it does |
|---|---|
💥 plugin-blast-radius |
Guards destructive tool calls and operations that affect broad sets of data. |
🔍 plugin-code-scanner |
Scans AI-generated code for security risks and reports structured findings. |
🔒 plugin-data-leakage-prevention |
Detects and masks sensitive data before it is sent in agent prompts. |
🧰 plugin-mcp-scanner |
Inventories MCP servers, tools, and calls for visibility and audit. |
📏 plugin-rules-enforcer |
Evaluates agent activity against user- and organization-defined rules. |
🔐 plugin-sensitive-access |
Detects secret access, environment-file reads, and possible exfiltration attempts. |
📡 plugin-siem-exporter |
Exports OpenLeash events and logs to SIEM destinations. |
🧠 plugin-skill-scanner |
Reviews agent skills and reports suspicious or risky behavior. |
🪙 plugin-token-saver |
Reduces prompt token usage before model calls to lower cost and latency. |
OpenLeash is the agent control layer for AI agents.
It gives teams and builders one place to observe agent activity, shape prompts, reduce token cost, scan tools and skills, route approvals, enforce policy, and add new capabilities through plugins.
An agent does something: submits a prompt, calls a tool, starts a session, changes a skill, produces a response, or touches an MCP server. OpenLeash catches that moment, turns it into an event, runs the plugins subscribed to that event, and returns a result when the agent needs one.
agent action
-> OpenLeash observes it
-> OpenLeash emits a normalized event
-> matching plugins run in order
-> OpenLeash returns allow, deny, ask, transformed prompt, inventory, audit, or metadata
That makes OpenLeash bigger than a security product. Security is one important use case, but the same pipeline also handles token compression, prompt shaping, MCP inventory, skill scanning, audit context, approvals, policy decisions, and future community-built agent features.
User submits a long prompt
-> event: prompt.beforeSubmit
-> token-saver reduces token cost
-> data-leakage-prevention checks the final prompt
-> sensitive-access checks secret exposure and exfiltration risk
Agent calls a tool or MCP server
-> event: tool.beforeUse
-> sensitive-access checks secret access
-> blast-radius checks destructive scope
-> rules-enforcer checks policy
-> mcp-scanner records inventory and audit context
-> OpenLeash returns allow, ask, or deny
OpenLeash detects a new agent skill
-> event: skill.changed
-> skill-scanner reviews the skill
-> OpenLeash stores the finding or asks for review
Agent finishes work
-> event: agent.response
-> response-aware plugins can evaluate output, add audit context, or trigger follow-up workflows
Agents are leaving the chat box.
They read repos, edit files, call tools, run shell commands, browse SaaS apps, touch tickets, inspect databases, interact with MCP servers, and work across local and cloud environments.
The hard problem is not only "block dangerous things." It is:
- What did the agent try to do?
- Which tools and MCP servers did it use?
- What context did it send?
- Which plugin changed or checked the request?
- Was a human asked?
- What should happen next?
OpenLeash is built to make those answers clear, programmable, and auditable.
Plugins are small, focused features that subscribe to OpenLeash events.
Each plugin has:
- a manifest with name, version, events, permissions, settings, effects, and ordering
- a handler that receives event input
- stable primitive capabilities for evaluator LLM calls, plugin-scoped storage, notifications, signals, usage, logs, audit, and reviewed host context
- typed results that OpenLeash merges into the final agent response
Plugins do not import OpenLeash internals. They own their detection logic, prompts, schemas, parsing, and fallbacks. OpenLeash provides primitive capabilities and decides how those primitives are fulfilled in OpenLeash Cloud or Private Cloud.
Start with any first-party plugin repo under the open-leash/plugin-* pattern.
| Plugin | Event | What it does |
|---|---|---|
plugin-token-saver |
prompt.beforeSubmit |
Reduces prompt size before downstream checks. |
plugin-data-leakage-prevention |
prompt.beforeSubmit |
Masks or blocks sensitive data in prompts. |
plugin-sensitive-access |
prompts, tools, responses | Detects secret-file reads, env dumps, and exfiltration attempts. |
plugin-blast-radius |
tool.beforeUse |
Guards destructive tool and data operations. |
plugin-rules-enforcer |
prompts, tools, responses | Evaluates user and agent rules. |
plugin-mcp-scanner |
tool.beforeUse, tool.afterUse |
Inventories MCP tool usage for audit and review. |
plugin-skill-scanner |
startup, agent detected, skill changed | Reviews agent skills and records findings. |
Use OpenLeash to understand and shape what agents do across prompts, tools, shell commands, files, MCP servers, and code workflows.
Use OpenLeash to configure plugins, route approvals, track usage, review audit history, and roll out agent controls through OpenLeash Cloud or Private Cloud.
Use OpenLeash to make agent behavior visible and enforceable without banning the tools people actually want to use.
Build focused pipeline features: cost reducers, prompt transforms, approval workflows, MCP inventory plugins, policy packs, session analyzers, data classifiers, and more.
OpenLeash has two backend-backed deployment paths:
- OpenLeash Cloud: hosted by OpenLeash for individuals and organizations.
- Private Cloud: customer-hosted open-source core for organizations that need their own API, dashboard, database, identity, logs, and operational controls.
The desktop client still receives local hooks first at 127.0.0.1, but account state, plugin settings, policy, approvals, audit, and evaluation come from the configured backend.
Agents should be useful, fast, and connected.
Humans should still understand what happened.
Teams should be able to adopt agents without turning every workflow into blind trust or blanket denial.
OpenLeash is the middle layer: observable, configurable, extensible, and open.
