Skip to content
Bounds

Your agent can read anything.
It cannot act on it without asking.

An agent's danger is usually the sequence, not the step: a permitted read, then a permitted send. Bounds evaluates each call against the path of its task and the rules you wrote, refuses what breaks one, and records the verdict with a reason you can read and hand to somebody else.

npm packageSource on GitHub
Update log22 releases · newest 0.13.2, 6 November 2026
  1. 0.13.2
    6 November 2026
    • The serializer signs exactly what the file stores: an undefined member, a Date or an array hole can no longer make an entry unverifiable.
    • verify reports how many entries before a broken one still verify, and a torn final line is announced instead of passing.
    • status names the mode file it read and warns when a second one disagrees; --version answers.
    • The ledger records the engine that wrote it. Node 22 is the floor.
  2. 0.13.1
    5 November 2026
    • A read-only release check runs before a publish.
    • The ledger is read by byte range, and a preview read fails closed.
    • Preview capture is fuzzed over 2,000 seeded inputs.
  3. 0.13.0
    5 November 2026
    • Run boundaries: a signed run start and end, with an outcome.
    • A per-run budget in tokens or dollars, enforced on the next call.
    • A local redacted preview per tool call, read with attesso detail.
    • A rule can block while the rest of the file keeps observing.
  4. 0.12.3
    4 November 2026
    • A rule stops firing on fields the entry never had.
    • The 24-hour decision summary is published in the reference.
    • First run survives a real harness install.
  5. 0.12.2
    4 November 2026
    • A usage entry signs without a phantom model field.
  6. 0.12.1
    4 November 2026
    • Two writers can no longer reclaim the same dead lock at once.
  7. 0.12.0
    4 November 2026
    • Hosted review and decision views, with keyset cursors and filters.
    • Measured token usage, read from the hook payload and never inferred.
    • Every call for the day can be exported, not just the loaded page.
  8. 0.11.1
    4 November 2026
    • The source repository and its test workflow are published.
  9. 0.11.0
    3 November 2026
    • Packets and workspace setup from the local control surface.
    • The workspace config stays private and its key shape is validated.
  10. 0.10.0
    3 November 2026
    • Rule drafts stay scoped to the day they were written on.
    • Draft export is disabled until a draft exists, and says why.
  11. 0.9.0
    3 November 2026
    • Hosted policy bundles are pulled and verified before they apply.
    • Status tells the truth about the ledger the hook is wired to.
  12. 0.8.0
    2 November 2026
    • sync --watch keeps the hosted mirror current during a long session.
  13. 0.7.1
    2 November 2026
    • The sync cursor restarts when the ledger key changes.
  14. 0.7.0
    2 November 2026
    • A cursor, batches and a device id: the ledger mirrors to a workspace.
  15. 0.6.1
    2 November 2026
    • The first-run setup hint stops repeating.
  16. 0.6.0
    2 November 2026
    • Bounded day and cursor queries replace the single-page view.
    • Strict shell scope fails closed at the hook.
    • A stdio control server exposes status, connect, mode and paths over MCP.
  17. 0.4.1
    31 October 2026
    • setup, explain and suggest, with a repeat defined as the same arguments.
    • Ceilings on a task, not only on a step.
    • The package says it is Bounds.
  18. 0.4.0
    31 October 2026
    • Veto a tool call before it runs, from any harness that speaks the hook.
  19. 0.3.1
    31 October 2026
    • Republish: no package change is recorded for this version.
  20. 0.3.0
    31 October 2026
    • Rules judge the path of a task, not one call in isolation.
    • Any action can be logged, not only payments.
    • The overview makes the numbers legible.
  21. 0.0.1
    31 October 2026
    • A local signed ledger people can install and verify.
  22. 0.0.0-stage
    31 October 2026
    • The first publish, replaced a minute later by 0.0.1.
Local, in one command

Install it and watch it refuse.

npx attesso init
npx attesso log --action web.read  --subject docs.example --task job-1 \
  --trust untrusted --capability read
npx attesso log --action mail.send --subject partner@example.com --task job-1 \
  --capability send
# #2 DENY mail.send partner@example.com
#    (PATH_DENIED by step #1 under no-send-after-untrusted-read)
npx attesso prove 2 --out receipt.json
npx attesso verify-receipt receipt.json
npx attesso report
npx attesso ui

No account, no server, no key to register. The ledger is hash-chained and signed locally, and attesso report shows what ran, what was refused, and what it cost in tokens and dollars. A receipt verifies in an empty directory with the public key: it proves the entry is in the log whose head this key signed, not that a human approved it.

npx attesso ui opens the same ledger as a local control surface at 127.0.0.1, and npx attesso sync mirrors decision summaries to a paid workspace. The local tier stays free and unlimited.

What it does

Path rules, refusals with reasons, and a record.

  • Rules judge the task path, not one call: a send after an untrusted read is refused, and the refusal names the step that tainted it.
  • Step and repeat ceilings stop a loop before it spends the afternoon: the same tool with the same arguments, refused at the limit you set.
  • Every verdict is recorded with its rule and the state it was judged against, so the answer to "what happened" is a file, not a memory.
  • Enforcement is steer first: on a repeat the earlier result is handed back, which is where tokens actually stop being spent.
What it saves

Money and exposure, kept apart.

  • Repeats and retry loops: in one measured session, 193 duplicate runs and 136 failure-shaped results out of 2,070 tool calls, an upper bound of 16% of that session's cost.
  • Actions outside the bounds a person signed: refused before they run, with a signed reason.
  • Context you did not need: a step or cost ceiling per task, enforced instead of noticed afterwards.

Waste is measured on your own sessions and quoted as a percentage of model spend. Incident avoidance is exposure, not a saving, and we do not multiply it by an invented probability.

What it does not do

The limits, stated here.

  • A local ledger key sits beside the log. It proves the file was not edited, not that a human authorised anything.
  • A local receipt proves one entry offline against the key that signed it; a stranger still has to trust that key. Hosted evidence verifies against published keys.
  • Local mode has no cross-device approval and no revocation beyond deleting the directory.

Human authority, cross-device keys and verification by a stranger need the hosted plane, where an approval is a passkey assertion over exact terms and the record verifies against published keys.

Measured, not modelled · 31 October 2026

What it saves, from runs we can point at.

193 of 2,070

tool calls were duplicates

In one long agent session. Together with 136 failure-shaped results that is an upper bound of 16% of its $3.19 cost, $0.51. An inventory, not a bill we saved.

28×

one looped task cost

A retrying task burned 37,150 tokens against 1,332 for the same task minutes later. That spread is what a step or repeat ceiling ends.

+66%

median tokens when a refusal lands on wanted work

Refusing an action the agent needed costs tokens, so the ceiling is the point, not the refusal. Watching in observe mode costs +9.7%.

We publish no average savings percentage, because we have not measured one that survives its own noise: a refusal only pays when it ends a loop, and it costs+66% when it lands on work you wanted. The report shows your numbers, from your sessions, with the date on them.

What it costs

Nothing until the record leaves your machine.

  • Free and unlimited on your own machine. Rules, ledger, report, hook; nothing metered.
  • $0.00085 per synced decision when the record has to leave your laptop, about $34 a month for a developer running 40,000 agent calls.
  • No plan, no seats, no minimum. $2 of credit to start, about 2,350 decisions, no card.

Synced means a receipt Attesso signed, verifiable by someone who trusts neither you nor us. Decisions made offline are never metered. Volume and platform contracts: contact sales.

Who signed it

A local key proves integrity. Ours proves it to a stranger.

MethodWhat it provesWhere it fits
Local Ed25519 keyThe ledger was not edited, and one entry proves offlineFree, on your machine
Attesso receipt (ES256)A third party verifies the decision without trusting youHosted, per synced decision
Passkey (WebAuthn)A human approved these exact termsHosted, approvals

A receipt names which signer it carries. A record claiming human authority must carry a WebAuthn assertion; a local or CI key is not interchangeable with one, and the verifier refuses the combination.

Commands and refusal codes: docs.attesso.com/bounds. Install from npmjs.com/package/attesso, read the source at github.com/Attesso/bounds.

Install it and watch it refuse.

Free on your machine, no account. $0.00085 per synced decision when the record has to travel.

Read the docsTalk to us