Cordum Agent Control Plane
Govern risky AI-agent actions with policy checks, human approval, and auditable evidence before execution.
- Source repo
- cordum-io/cordum
- Stars
- ★ 509
- Last updated
- 9d ago
- License
- NOASSERTION
- Primary language
- Go
- FA score
- 64/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude Code
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A platform engineering team needs policy checks and human approval before agent-initiated Terraform, Kubernetes, or cloud production changes.
- Not a fit if
- Teams that want a hosted cloud service instead of running Docker and generating certs themselves
- Environments that cannot run Docker or allocate 4 GB of memory
- Users who need out-of-the-box governance for local agents other than Claude Code
- Source review
- 64/100 · Some gaps
What does this agent do, and when should you use it?
Cordum is a self-hosted agent control plane that evaluates policy, blocks actions, or requests human approval before autonomous agents execute. Its full stack includes an API Gateway, Scheduler, Safety Kernel, Workflow Engine, Context Engine, NATS, TLS-secured Redis, and a React dashboard. Jobs enter through the Gateway, are governed by the Scheduler and Safety Kernel, and can be executed by CAP-compatible workflows and workers that return audit events. It also exposes MCP in stdio and HTTP/SSE modes, while Cordum Edge adds a local command hook, approvals, and redacted evidence export for Claude Code tool calls. Deployment boundaries include Docker Compose, Helm/Kubernetes, and the Go SDK; Python and Node SDKs are listed as separate packages.
A client can submit a job with topic and prompt to POST https://localhost:8081/api/v1/jobs, authenticated by X-API-Key and X-Tenant-ID. The API Gateway accepts the job, the Scheduler coordinates Safety Kernel policy evaluation, and the result can be ALLOW, DENY, or REQUIRE_APPROVAL; the Workflow Engine orchestrates workflows. CAP workers can register a topic handler such as job.summarize through runtime.Register and start with agent.Start(). cordumctl edge claude renders a temporary settings.json, starts cordum-agentd on a local loopback nonce, and governs Claude Code tool calls through a command hook; approved destructive actions also require a resolved approval audit event matching the tenant, approval_ref, and action_hash. The dashboard can show session timelines, and Edge exports redacted evidence bundles.
- A platform engineering team needs policy checks and human approval before agent-initiated Terraform, Kubernetes, or cloud production changes.
- A development team using Claude Code wants to deny risky terminal commands, require approval for Edit/Write operations, and retain session evidence.
- A Go developer building a CAP-compatible worker needs governance decisions around handlers registered for
job.*topics. - A security or compliance team needs a central view of approvals, policy decisions, and audit events across several agent pools.
- A team using MCP tool integrations needs a governed path through
cmd/cordum-mcpin stdio mode or the Gateway endpoints/mcp/messageand/mcp/sse.
How do you install or deploy this agent?
Install Docker Desktop v4+ (or Docker Engine v20.10+ with Compose v2), allocate at least 4 GB to Docker, and install Go 1.26.3+ and curl. Run:
git clone https://github.com/cordum-io/cordum.git
cd cordum
./tools/scripts/quickstart.shThe script starts the full stack and generates secrets and certificates. The dashboard is available at http://localhost:8082; the initial login is admin / ChangeMe123!, which should be changed in .env before exposing the stack.
How do you use this agent?
Load the generated credential: export CORDUM_API_KEY=$(grep CORDUM_API_KEY .env | cut -d= -f2). Submit a first job:
curl -sS --cacert ./certs/ca/ca.crt -X POST https://localhost:8081/api/v1/jobs -H "X-API-Key: $CORDUM_API_KEY" -H "X-Tenant-ID: default" -H "Content-Type: application/json" -d '{"topic":"job.default","prompt":"hello"}'For the built-in three-verdict demonstration, run cordumctl pack install ./demo/quickstart/pack and then cordumctl demo run quickstart. To enable Claude Code Edge against a running stack, set CORDUM_GATEWAY, CORDUM_API_KEY, and CORDUM_TENANT_ID=default, then run ./bin/cordumctl edge claude.
What are this agent's strengths and limitations?
- The Safety Kernel produces explicit allow, deny, or approval-required decisions before execution rather than only recording outcomes afterward.
- Cordum Edge provides a Claude Code command hook, local
cordum-agentd, resolved-approval provenance checks, and redacted evidence export. - It combines CAP worker runtime support, MCP stdio/HTTP/SSE interfaces, and Docker Compose plus Helm deployment paths.
- Published images support linux/amd64 and linux/arm64, and the repository documents cosign keyless OIDC signing for release-tag images.
- A full local deployment requires Docker, Compose, and at least 4 GB of Docker memory; first-run certificate generation also requires Go 1.26.3+.
- Edge is explicitly documented for Claude Code today; enterprise enforcement additionally depends on managed Claude settings and endpoint controls.
- The documented compatibility defaults are
CORDUM_SDK_HANDSHAKE=offandCORDUM_HEARTBEAT_MODE=authority; stricter modes require worker proof keys and control-plane signing authorities. - The license is BUSL-1.1: internal self-hosting and modification/contribution are permitted, but offering a competing hosted service is not; conversion to Apache-2.0 is dated 2029-01-01.
How does this agent compare with similar options?
The repository compares Cordum with Guardrails AI, NeMo Guardrails, and custom middleware. Its stated differentiators are pre-execution Safety Kernel checks, built-in human approvals, multi-agent-pool governance, deterministic audit, framework-agnostic CAP access, MCP Bridge/Gateway support, and a Claude Code local-action firewall. This comparison is the repository's own feature positioning.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Cordum Agent Control Plane This agent | 64 · Some gaps | Self-hosted serviceFree | ★ 509 | 9d ago | Go | Claude Code |
| Tracekit Agent Audit and Policy Guard | 82 · Good | CLIFree | ★ 468 | 1d ago | Python | Claude Code |
| Vessel Browser | 58 · Major gaps | Desktop appFreemium | ★ 138 | 1mo ago | TypeScript | OpenAI API · Claude API |
| SandBase Harness | 52 · Major gaps | CLIFree + model costs | ★ 640 | 1d ago | TypeScript | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README describes policy evaluation, human approval, output quarantine, audit trail; Edge requires approval and evidence export; SDK example requires explicit AllowUnsigned, fail-closed by default. Deductions: no concrete least-privilege configuration examples, and actual execution not verified.
Evidence shows: README and CI workflows are consistent; CI includes tests, integration tests, lint, security scans; dependencies pinned with go.sum and pnpm-lock.yaml. Deductions: no specific failure message examples, and actual execution not verified.
Evidence shows: README provides multiple deployment options (docker compose, Helm, source install), supports various environments; Edge has dedicated docs for Claude Code; SDK supports Go, Python, Node. Deductions: capability boundaries and trigger conditions not explicitly detailed.
Evidence shows: README is well-structured with quickstart, docs links, architecture diagram; install notes detailed; naming consistent; examples and FAQ present; license is BUSL-1.1; versioning and CI badges present; maintenance responsibility mentioned. Deductions: known limitations not explicitly listed.
Evidence shows: README provides clear output examples (e.g., demo table), value proposition clear, cost-benefit implied in quickstart. Deductions: no performance or resource consumption data.
Evidence shows: README claims align with code and CI workflows, e.g., cosign signing, CI tests; multiple sources (README, CI, SECURITY.md) corroborate; facts and inferences clearly separated. Deductions: no independent verification results.
- Static review only; no execution performed; scores based on source and documentation.
- Publisher identity unverified; treat with caution.
- Default password 'ChangeMe123!' and API key generation must be changed in production.
- BUSL-1.1 license may restrict certain commercial uses.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
What's Changed * build(deps): bump golangci/golangci-lint-action from 7.0.1 to 9.2.1 by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/330 * build(deps): bump sigstore/cosign-installer from 3.9.1 to 4.1.2 by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/334 * [bug] scheduler: route critical-section state writes through the lock-fence context (CRD-14, task-7754adfb) by @yaront1111 in https://github.com/cordum-io/cordum/pull/339 …View on GitHub ↗ -
Release notes excerpt
What's Changed * build(deps): bump github.com/cloudflare/circl from 1.6.2 to 1.6.3 by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/286 * Action gates EDGE-102/103 production wiring by @yaront1111 in https://github.com/cordum-io/cordum/pull/285 * build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.1 by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/284 * build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/283 …View on GitHub ↗ -
Release notes excerpt
What's Changed * build(deps): bump fast-uri from 3.1.0 to 3.1.2 in /docs-site by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/251 * build(deps): bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 in /docs-site by @dependabot[bot] in https://github.com/cordum-io/cordum/pull/259 * feat(pack,safetykernel): metadata.aliases + constraints additive-extension (Backend 6, task-e4e9489c) by @yaront1111 in https://github.com/cordum-io/cordum/pull/261 * feat(dashboard): PR D split — hero page migrations by @yaront1111 in https://github.com/cordum-io/cordum/pull/266 …View on GitHub ↗
FAQ
Is Cordum limited to one model or agent framework?
Can it be deployed without building every service from source?
docker compose pull && docker compose up -d uses published images, but that path still requires go run ./cmd/cordumctl generate-certs for local certificates and configuration of an API key and Redis password.How does Claude Code approval avoid authorizing an action from a request event alone?
approval_ref, and action_hash; an approval-requested event alone is insufficient.What credential precautions apply in production?
.env should be changed. The Helm guidance also advises against passing API keys or Redis passwords on the command line because they enter stored Helm values and shell history.