Kepil MCP server

Kepil

<!-- mcp-name: io.github.oleg-vdv/kepil -->

Accountability layer for AI agents. Give every agent a passport, put every action through one gate, and keep a log that cannot be rewritten afterwards.

53% of organisations have had an AI agent exceed its intended permissions.

48% of agents in production run with no monitoring at all. Only 22% treat an

agent as an entity with its own identity.

— Cloud Security Alliance and State of AI Agent Security, 2026

Kepil is what the other 78% are missing: identity, mandate, enforcement, evidence — and the part nobody else does, undo.

pip install kepil
python -m kepil.admin        # http://localhost:7317

Русская версия: README.ru.md

What it does

Passport. Every agent version gets an immutable card: who built it, who runs it, what it does, what it will never do, its risk class, its autonomy class, its limits, and when its risks are due for review. A new version is a new card; the old one is kept forever.

Mandate. A machine-readable power of attorney for one job: allowed actions, allowed systems, spending limits, a validity window, and which action types must be confirmed by a human. Anything not explicitly allowed is refused.

Gate. The single point through which an agent touches the outside world. Every action is checked against the mandate before a model is even called. Fail-closed: any error inside the check means refusal, never a pass.

Journal. Append-only JSONL where every record carries the hash of the one before it. Editing or deleting a record is detectable — by anyone, using an independent implementation:

npx proofbyte-agent-trace verify data/journal.jsonl

Undo. The journal is a graph of actions, and every profession declares its compensating action. Kepil walks that graph backwards and stops honestly at the first step that cannot be undone. Agent platforms record what happened; this one puts it back.

Confirmations on your phone. Irreversible actions arrive in Telegram with two buttons — approve or return — so being accountable does not mean sitting at a laptop.

Use it from any MCP client

Kepil ships an MCP server, so an editor, an assistant or another agent can work through it — and every action still passes the same gate into the same journal.

{
  "mcpServers": {
    "kepil": { "command": "python", "args": ["-m", "kepil.mcp"] }
  }
}

Seven tools: list professions, create an order, run a step, read order status, see what is waiting for a human, verify the journal, read an agent passport.

One tool is deliberately missing: confirmation. If a model could approve an irreversible action, the human would drop out of the chain and the whole design would be pointless. The confirmation card goes to a person — in the panel or in Telegram — and no MCP client can press it. A test enforces this.

Guard your existing automations

Kepil has a small JSON API, so an n8n workflow, a Make scenario or your own script can ask permission before acting:

curl -X POST http://localhost:7317/api/check   -H "Authorization: Bearer $KEPIL_API_TOKEN"   -H "Content-Type: application/json"   -d '{"order_id":"ord-0042","action":"send:message","system":"whatsapp.local"}'

{ "decision": "await_human", "allowed": false, "needs_human": true,
  "reason": "необратимое действие: требуется подтверждение человека" }

The answer is recorded in the journal, so later you can show on what grounds the automation did — or did not do — something. For n8n there is a ready node: n8n-nodes-kepil.

Shortened. The full README is on GitHub.