Skip to content

Independent referee & evidence standard for AI agents

Your AI agent can move money, change records, and place trades. MakerChecker proves it never approved its own action.

MakerChecker is a self-hosted checkpoint in front of your agent. It enforces segregation of duties in code: the agent that proposes an irreversible action is refused as its own approver, a hard 403, not a prompt-level promise. Because this boundary sits outside the model, even a fully compromised agent cannot sign off its own work. Every decision commits to a signed, hash-chained log your auditor can verify offline, with no access to your systems. That independent proof is what gets the agent into production.

Book a VPC-hosted pilotTry the offline verifier

Self-hosted in your own cloud · every record is hash-chained and signed · open verifier, Apache-2.0

The free front door

Find what your agent can do on its own. Run mc scan in CI/CD.

Before your agent ever touches production, discover exactly what it is capable of doing on its own. Our open-source static code scanner reads your agent's tool definitions and flags ungoverned, catastrophic actions.

Every finding matches a real incident: each one maps to a documented failure from our database of 41 agent incidents, from database wipes to runaway billing loops.

Runs locally by default: the default scan is deterministic and offline, with no signup, no server, and no telemetry. The one network path is opt-in: pass --llm to send ambiguous tools to the Anthropic API for a second opinion, and every such finding is labeled.

The policy is code: the scan writes your mc-policy.json file. Commit it and your own CI scan passes, turning a standard GitHub Actions workflow badge green. It is your CI's badge, nothing phones home. The self-hosted MakerChecker engine enforces the exact same file in production.

Scan your agent, freeSee the incident database

Developer Terminal

npx @makerchecker/scan .

Scanning tool definitions in /usr/src/app...
[CATASTROPHIC] Tool 'transfer_funds' has no preceding approval gate.
  Resembles: AID-2026-0004 (Morse Code Prompt Injection Grok Wallet Drain)
  Fix: Add approval_gate control in mc-policy.json

[HIGH] Tool 'delete_database' has no preceding gate.
  Resembles: AID-2025-0008 (Amazon Q VS Code extension database-wiping prompt injection)
  Fix: Add limit_violation or approval_gate

Scan failed. Found 1 CATASTROPHIC and 1 HIGH risk ungoverned capabilities.
To fix the build, run: npx @makerchecker/scan init .

Gate

cold-chain · pallet VX-4471 · excursion 41 min

awaiting sign-off

  • Excursion caught live · pallet quarantinedsafe direction · agent acted alone

  • Stability data pulled · disposition case assembled

One-way door

Destroy, six figures of productRelease against stability data

The agent cannot decide this. A named QA person signs, recorded reason required.

“Excursion within validated stability range for this product. Releasing pallet VX-4471.”

Signed by M. Adeyemi · qualified person (human) · 14:08:11
Decision sealed in chainrequester ≠ approver

Runtime containment

Jailbreaks always succeed. We stop the consequence.

Prompt filters are probabilistic. MakerChecker is a deterministic runtime fence outside the LLM. We do not try to build a better prompt-injection filter; instead, we scope the physical blast radius of the agent's tools.

A compromised or hallucinating agent can still misuse what it was granted on reversible actions. But it is structurally barred, in code, at the execution boundary, from taking an irreversible action or approving its own work without a second, named human.

See where it stops for a humanRead the security model

The evidence standard

A company cannot issue its own financial audit. Neither can an agent self-certify.

An agent framework vendor or an operator's internal database cannot independently vouch for their own compliance. The party that did the work is the wrong one to vouch for the record. MakerChecker is the independent referee.

Every action, block, and signature commits to an Ed25519-signed, SHA-256 hash-chained audit log. An inspector recomputes the math on their own laptop, completely offline. If a single database row was altered, verification breaks.

Verify a run yourselfWhy it is independent

Offline verification

Press Verify. The record re-checks itself in your browser, with no code of ours and no access to our systems, the same check an auditor runs.

Change one line. It breaks, and points at the line you changed. The action and the log are written together, so “acted but didn't log” can't happen.

Read it in plain English. Not a green checkmark for engineers. It names the person, the decision, the time, and the proof the agent didn't act alone.

How it works

The agent clears the routine work. It can't approve the one call that matters.

Before the agent acts, the engine decides what it can do on its own and what a named person must sign. Routine cases close now. The call that matters waits for a human, every time. Then anyone can check the record for themselves.

AI agent

Proposes a consequential action

Take a consequential actionSubmit a filingAttest eligibilityClose a case

MakerChecker gate

  • Granted skill

    Deny by default. Only the skills you grant, at your tier.

  • Independent sign-off

    The proposer cannot approve. A second human signs off.

  • Signed audit

    Proof

    Every step written to a tamper-evident, signed record.

Refused

Ungranted skill or self-approval is blocked

Refused before it runs. Not flagged after.

Only then

The action runs

always written

Audit pack

Hash-chained, Ed25519-signed evidence

Regulator

Verifies it offline, with none of our code

Chain verified

Ed25519 · verified offline

Try the live demo

Watch an agent get blocked from approving its own work, then sign off as the officer. In your browser, no signup.

Integration

It wraps the tools your agent already calls. Same names, same setup, nothing to rebuild.

Our SDK wraps the tools your agent already calls, on whatever framework it runs. The names and schemas do not change. The gate decides before anything consequential runs, and every call is signed into the audit, with nothing to rebuild.

import { createClient } from "@makerchecker/sdk";
import { governLangChainTool } from "@makerchecker/connector-langchain";


// Point at your own self-hosted MakerChecker. We never see your data.
const mc = createClient({ baseUrl: process.env.MAKERCHECKER_URL });
const { session } = await mc.proxy.openSession({ label: "agent-run" });


// Govern a tool your agent already calls. Its name and schema do not change.
const governedTool = governLangChainTool(
  mc,
  { sessionId: session.id, agentName: "transaction-agent", skillRef: "transfer-funds@1" },
  rawTool,
);


// A denied action throws before the tool runs,
// and every call is signed into the audit trail.
await governedTool.invoke(input);

A denied action throws before the tool runs

Every call is signed into the audit. The agent calls its tools normally; the gate decides, fail-closed, before anything consequential runs.

Any framework, no migration

Typed connectors ship for LangChain and the Claude Agent SDK; CrewAI, LlamaIndex, and AutoGen connect through the generic SDK adapter. We meet your agent where it runs.

Open and self-hosted

Open source and self-hosted, so your security team can read every line.

See how the connectors work →

Solutions

Built for high-stakes, regulated work

While the MakerChecker engine itself is completely domain-agnostic, we build and run the first agent with you in the industries where compliance and legal carry personal liability.

LIFE SCIENCES & PHARMA SAFETY

Pharmacovigilance and device complaints

Automate drug-safety (PV) case processing, MDR device complaints, and cold-chain stability reviews under a named QPPV or PRRC. Produces the signed, offline-verifiable evidence your own auditors expect under GAMP-5 and 21 CFR Part 11 workflows.

Explore life sciences →

PHARMA REIMBURSEMENT

Patient access and steering defense

Clear the prior-authorization and appeals queue while gating the steering-sensitive copay and foundation enrollments. Bind each enrollment to a signed, offline-verifiable record your own counsel and auditors can inspect.

Explore patient access →

BANKING & CAPITAL MARKETS

Four-eyes for money-moving agents

Let the agent prepare the payment run, the rebalance, or the close, then hold the release, the limit breach, and the ledger posting for a named second signer. The oldest control in banking, enforced in code and backed by an offline-verifiable log.

Explore money-movement cases →

Complementary, not a competitor

Your control plane runs the agents. We're the proof an outsider can check.

An agent control plane gives your team identity and monitoring inside your own walls. That's where you run the fleet. We sit on top: a signed record an outside examiner recomputes offline, with no access to your systems and none of our code. Change one row and the chain breaks at that row. They tell you the fleet is governed. We give you the record an outsider can check without taking your word for it.

See where MakerChecker fits →

MakerChecker Pilot

Get your agent out of the sandbox and into production.

Book a $25k VPC-hosted pilot. We will build your agent's first governed flow, run it inside your own walls, and deliver an inspection-ready cryptographic audit bundle.

Book a pilotVerify a run yourself

Self-hosted in your cloud · Apache-2.0 SDK · AGPL-3.0 core · synthetic or minimized data setups

Read deeper

MakerChecker is built on a general engine for approving and proving autonomous action, in healthcare, finance, and any domain where a step can't be undone. See the engine →