Cordum Agent Control Plane

What does this agent do, and when should you use it?

Cordum is a self-hosted agent control plane that evaluates policy, blocks actions, or requests human approval before autonomous agents execute. Its full stack includes an API Gateway, Scheduler, Safety Kernel, Workflow Engine, Context Engine, NATS, TLS-secured Redis, and a React dashboard. Jobs enter through the Gateway, are governed by the Scheduler and Safety Kernel, and can be executed by CAP-compatible workflows and workers that return audit events. It also exposes MCP in stdio and HTTP/SSE modes, while Cordum Edge adds a local command hook, approvals, and redacted evidence export for Claude Code tool calls. Deployment boundaries include Docker Compose, Helm/Kubernetes, and the Go SDK; Python and Node SDKs are listed as separate packages.

A client can submit a job with topic and prompt to POST https://localhost:8081/api/v1/jobs, authenticated by X-API-Key and X-Tenant-ID. The API Gateway accepts the job, the Scheduler coordinates Safety Kernel policy evaluation, and the result can be ALLOW, DENY, or REQUIRE_APPROVAL; the Workflow Engine orchestrates workflows. CAP workers can register a topic handler such as job.summarize through runtime.Register and start with agent.Start(). cordumctl edge claude renders a temporary settings.json, starts cordum-agentd on a local loopback nonce, and governs Claude Code tool calls through a command hook; approved destructive actions also require a resolved approval audit event matching the tenant, approval_ref, and action_hash. The dashboard can show session timelines, and Edge exports redacted evidence bundles.

1. A platform engineering team needs policy checks and human approval before agent-initiated Terraform, Kubernetes, or cloud production changes.
2. A development team using Claude Code wants to deny risky terminal commands, require approval for Edit/Write operations, and retain session evidence.
3. A Go developer building a CAP-compatible worker needs governance decisions around handlers registered for `job.*` topics.
4. A security or compliance team needs a central view of approvals, policy decisions, and audit events across several agent pools.
5. A team using MCP tool integrations needs a governed path through `cmd/cordum-mcp` in stdio mode or the Gateway endpoints `/mcp/message` and `/mcp/sse`.

What are this agent's strengths and limitations?

How do you install or deploy this agent?

Install Docker Desktop v4+ (or Docker Engine v20.10+ with Compose v2), allocate at least 4 GB to Docker, and install Go 1.26.3+ and curl. Run:
git clone https://github.com/cordum-io/cordum.git
cd cordum
./tools/scripts/quickstart.sh
The script starts the full stack and generates secrets and certificates. The dashboard is available at http://localhost:8082; the initial login is admin / ChangeMe123!, which should be changed in .env before exposing the stack.

How do you use this agent?

Load the generated credential: export CORDUM_API_KEY=$(grep CORDUM_API_KEY .env | cut -d= -f2). Submit a first job:
curl -sS --cacert ./certs/ca/ca.crt -X POST https://localhost:8081/api/v1/jobs -H "X-API-Key: $CORDUM_API_KEY" -H "X-Tenant-ID: default" -H "Content-Type: application/json" -d '{"topic":"job.default","prompt":"hello"}'
For the built-in three-verdict demonstration, run cordumctl pack install ./demo/quickstart/pack and then cordumctl demo run quickstart. To enable Claude Code Edge against a running stack, set CORDUM_GATEWAY, CORDUM_API_KEY, and CORDUM_TENANT_ID=default, then run ./bin/cordumctl edge claude.

How does this agent compare with similar options?

FAQ