GVNR
GVNR (Enforcer Governor) is the governor for AI agents, made by Instruxi. It runs in Claude Code today, with Codex, Cursor, Gemini CLI, Grok, Hermes and OpenClaw coming soon. Before an agent's tool call runs it answers allow, rewrite, ask or deny, based on a spend limit per agent, dollar-per-minute rate limits, loop detection and rules about what the agent may do. Every decision is appended to a hash-chained record.
In Claude Code, run /plugin marketplace add instruxi-io/claude-plugins, then /plugin install enforcer@instruxi and /plugin install enforcer-governor@instruxi, and restart Claude Code. Sign in with /enforcer:login if you have an Enforcer workspace. The quickstart has the status line to paste.
Enforcement runs in Claude Code, today. It runs in Claude Code's own hooks and sees every tool call before it runs, including the ones that cost nothing, like rm -rf or reading a credential file. Support for Codex, Cursor, Gemini CLI, Grok, Hermes and OpenClaw is coming soon; meanwhile they can connect to your workspace through the Enforcer MCP server at https://api.instruxi.dev/mcp. Setup for each, or have your agent follow agents.md.
No. Without signing in, GVNR decides and records on your machine and makes no network calls at all. Today GVNR is for personal use. Team use is coming soon: signing in to an Enforcer workspace will add one record for the whole team with a console, and organisation policy and settings.
Nothing until you sign in. Once signed in: decision receipts (verdict, rule, tool, model, tokens, project, operator; never command text, file contents or prompts), a policy question naming the rule when one matches, and, only if you turn it on, Claude Code's own OpenTelemetry. All of it goes only to the workspace you signed in to, and each has its own switch.
A $20 spend limit per agent, which stops the agent when reached, with a check-in at 75 percent. $2 a minute per agent, $10 a minute across all agents, 8 new agents a minute and 6 errors a minute each pause the agent and ask you. The same action 4 times in the last 8 is a loop, and the agent is stopped until you resume it. Day, week and month totals are off until you set them.
Claude Code has permission rules that you write yourself to allow, ask or deny tools, and GVNR ships a set of those too. It adds what permission rules do not: spend and rate limits, loop detection, a safer rewrite instead of a refusal, and a receipt for each decision, plus a shared team record once signed in.
The two halves fail in opposite directions on purpose. The rules need no state and fail closed, so they hold even when GVNR cannot read its own files. Spend and rate checks need state and fail open, saying so in the reason, because a guard that blocks real work over its own missing file gets uninstalled. Losing the network never allows more: the local rule decides alone.
GVNR is a guard against accidents and runaways, not a sandbox. Settings your organisation publishes cannot be lowered in the local config, but an agent with shell access on your machine can still interfere with its own guard. Against a deliberate adversary, isolate the agent and run GVNR on top.
GVNR itself works through hooks, not MCP, because an MCP tool is something an agent chooses to call and a hook is not. The enforcer plugin brings the Enforcer MCP server, whose governance tools let Claude answer questions about your workspace's spend and decisions.
That was GVNR's 0.x line: a local proxy and browser dashboard, published on npm. It is retired. GVNR is now the agent governor described on this site, running in Claude Code today, and the npm package and its MCP Registry listing are not maintained.
It is source-available under the FSL-1.1-ALv2 licence: free to use, including commercially and in production, and each release becomes Apache 2.0 two years after it ships. You may not offer it as a competing product. It is not OSI open source.
The plugin is free. Your model provider still bills you as usual; GVNR decides how fast, and on what, that money is spent. An Enforcer workspace, for the shared team record, is part of Instruxi's Enforcer service.
No, and it does not claim to. Nobody can do that reliably. It catches waste that is genuinely detectable, such as loops and runaway spend, blocks dangerous actions, and asks you about the judgment calls.