Show HN: Conduct, open-source guardrails for LLM and MCP tool calls

Conduct introduces an open-source runtime governance layer that places a single policy engine (Guard) and an LLM proxy (Router) between AI agents and their downstream actions. Guard evaluates every LLM call, shell tool invocation, and MCP tool call before execution, deciding to block, warn, audit, or inject based on signed configuration packs. Router forwards LLM provider SDK requests through Guard, ensuring the same policy applies regardless of the upstream provider. The system replaces post-hoc observability with a policy-first approach that produces a SHA-256 hash-chained audit log rooted at the workspace genesis.

Deploying Guard and Router locally involves cloning the repository, running docker compose to start the API, Canvas UI, Redis worker, and Postgres database. Installing the conduct CLI, running conduct login and conduct sync adds the agent hooks and pulls the active policy packs into the environment. For production use, the system can be self-hosted on Kubernetes using the supplied templates or accessed via the hosted service, where the free Discovery tier provides read-only visibility and paid tiers enable enforcement, Router access, and hash-chain verification API. Ongoing operation requires monitoring the Redis queues, Postgres state, and refreshing the signed configuration packs when policy updates are released.

Guard only enforces decisions at its three chokepoints: the CLI hook, the MCP layer, and the Router; any LLM call or tool invocation that bypasses these points is not subject to the policy. In fail-open (soft) mode, a missing or malformed policy pack results in the action being allowed, which can weaken protection if configuration is not carefully managed. The trust model relies on the integrity of the workspace signature; if the signing key is compromised, an attacker could push a tampered pack that would be accepted before verification fails. Verifying the hash-chained audit log requires running the provided verification script, meaning that tamper evidence is not automatically blocked without an explicit check.

The Discovery mode offers a 14-day read-only window that logs every AI action without requiring policy authoring or upstream changes, serving as a low-friction entry point. Out-of-the-box compliance packs cover frameworks such as OWASP, SOC 2, HIPAA, PCI DSS, EU AI Act, NIST AI RMF, ISO 42001, and language-specific packs for Python, Node, and Terraform. The repository also ships 22 pre-built playbooks in YAML format for common workflows like issue-to-PR, code review, incident response, and CI/CD triage, which can be edited and executed directly. While the system provides cryptographic proof of policy enforcement, the deployment must still allocate effort to author, test, and maintain custom policies that reflect its specific risk tolerances and regulatory obligations.