Govern tool calls
Check every action an agent takes before it runs, and record what happened.
Leap360 reads the tool calls a model asks for and classifies each one: shell commands, Kubernetes deletes, database drops, permission changes, deploys, payments and more. It flags credentials, personal data, production targets and "everything at once" arguments. Classification runs locally in well under a millisecond.
To govern the function that actually runs, wrap it.
import { Leap360, Leap360ActionBlockedError } from 'leap360';
const leap = new Leap360({ apiKey: process.env.LEAP360_API_KEY, projectId: 'my-app', serviceName: 'deploy-bot' });
const deleteNamespace = leap.wrapTool('delete_namespace', async ({ name }: { name: string }) =>
k8s.deleteNamespace(name),
);
try {
await deleteNamespace({ name: 'payments' });
} catch (err) {
if (err instanceof Leap360ActionBlockedError) console.log(err.gate.message); // blocked: the function never ran
}Every call is recorded with its outcome: ok or error, duration, and a redacted preview of the result. The full result is scanned locally for prompt injection and credentials; only the findings and the redacted preview leave your process.
What happens to a call
| Situation | Result |
|---|---|
| A policy allows it | It runs. In enforce mode the decision is made in your process from cached policies, in about 0.7 ms. |
| A policy blocks it (enforce mode) | It never runs. You get Leap360ActionBlockedError (JavaScript) or ActionBlocked (Python). |
| A policy holds it for approval | It throws APPROVAL_REQUIRED. Once a person approves it, that exact call can run for 15 minutes, so a retry passes. |
| Leap360 can't be reached | Only actions at or above failClosedAt (default critical) are blocked. |
| Leap360 refuses the request (a 4xx) | The call is blocked, so a call Leap360 won't check never runs unchecked. |
Wait for an approval instead of failing
const leap = new Leap360({ apiKey, projectId, serviceName: 'deploy-bot', approvalWaitMs: 120_000 });Options
| JavaScript | Python | Default | What it does |
|---|---|---|---|
mode | mode | From the console | Force shadow or enforce |
failClosedAt | fail_closed_at | critical | When Leap360 can't be reached, block calls at this risk or above |
approvalWaitMs | approval_wait (seconds) | 0 | Wait this long for a person to approve a held call |
decisions: 'server' | Local | Send every decision to the server instead of deciding allowed calls locally | |
status_ttl | 1.0 s | How long a kill switch status is reused | |
timeout | 2.0 s | How long to wait for Leap360 |
One API key per agent
Stopping an agent in the console also stops the API keys it used, so an agent cannot carry on under another name. Give each agent its own API key if you need to stop them separately.
Use the engine directly
The classifier is exported from the JavaScript SDK: classifyAction, extractToolCalls, scanText, redactSecrets, decideAction, suggestPolicies, replayPolicy. If your framework registers tools some other way, call declareTools() so the console knows every tool an agent can reach.