A thin client sends scoped requests to a broker daemon that enforces policy, performs the approved action, and records the result.
OpenScope governs the full agent trust perimeter. The AI Router governs what an agent sends to a model, DLP, metering, receipts, and the broker governs what an agent does, scoped actions through a protected executor, with human approval. Both run inside the customer's perimeter; the data and control paths stay yours.
Same philosophy, scoped, allowlisted, validatable, at two very different scales.
Open source, runs fully local, no server. The action broker governs Notes, Mail, SSH, and YAML-defined apps for Claude Code, OpenClaw, and Codex on your own host. Install it and go.
OpenScope runs as endpoints in your VPC, the AI Router (what agents see) and the Action Broker (what agents do), behind a customer-owned control plane, with a real-time SOC view your security team holds.
The flow above is the action side, what the agent does. The OpenScope AI Router governs the prompt side, what the agent sends to a model, before it leaves your VPC. One trust boundary, both halves.
Content-aware detection blocks proprietary source (HDL / SPICE / netlists), classification and export markers, secrets and PII, before a prompt ever reaches a model.
Every call is metered by model and Ed25519-signed, so spend reconciles without anyone reading prompt content.
It runs in your perimeter and is structurally blind to your content, the database refuses the query, and you can check it yourself in the demo.
Every OpenScope request follows the same predictable flow.
The agent requests a predefined operation rather than a raw tool surface.
OpenScope checks agent identity, app, action, and parameter-specific allow rules.
Automation approvals, credentials, profiles, or targets stay in the broker boundary.
Allow and deny outcomes are auditable after the fact.
A capability is narrower than a raw tool surface. Instead of generic shell or automation access, the broker exposes named actions whose parameters can participate in policy.
openscope notes list_notes --agent openclaw --folder Work openscope notes read_note --agent openclaw --folder Work --note "Sprint Plan" openscope mail list_messages --agent openclaw --mailbox Inbox --limit 20 --unread true
sudo openscope policy allow --agent my-agent --app notes --action list_notes --folder Work sudo openscope policy allow --agent my-agent --app notes --action read_note --folder Work sudo openscope policy deny --agent my-agent --app notes --action list_notes --folder Private
OpenScope starts with Notes and Mail and extends the same broker model to external systems through HTTP profiles, SSH targets, and YAML-defined custom apps.
Scoped actions for protected local apps instead of raw automation power.
Broker-owned base URLs and auth headers for integrations such as Jira.
Named targets and approved services rather than broad shell access.
YAML-defined actions that preserve the same trust boundary and policy model.
A Jira integration can be split into a broker-owned HTTP profile and a user-defined app manifest. The broker keeps the base URL and authorization header while the manifest defines narrow actions.
On macOS, OpenScope packages a signed runtime so stable Automation approval attaches to the broker, not to the agent. The CLI stays lightweight while the privileged daemon remains the narrow execution boundary.