GVNR for developers
GVNR lets many agents and many people work one large task without stepping on each other, and keeps what the work produced. The work lives in a plan: tasks, what each one waits for, and the criteria for done. Agents claim the next ready piece and report with evidence, a judge reads it, and people take the gates. The governor is one part: it writes a hash-chained receipt for every tool call and, when you switch its checks on, refuses the reckless one before it runs. GVNR is made by Instruxi and runs in Claude Code today. It also runs in Codex CLI, though not yet against a live Codex, and in Grok Build as an experiment; Cursor, Gemini CLI, Hermes and OpenClaw are coming soon. It is also reachable over the REST API and through MCP.
A graph of tasks. Each task says what it waits for and what done looks like, in acceptance lines a machine can run. Agents claim what is ready, a gate is a task only a person can close, and what the work produces (findings, verdicts, cost) stays with the plan. See the quickstart.
A judge reads a run's evidence against the criteria fixed when the task was claimed, and answers verified or not. A person can overrule it either way, and the overrule is on the record.
Yes. The plan is an HTTP API, so any app that can send a request can drive it. Call https://api.gvnr.io/api/v1/graph with an X-API-Key header. Browser apps built in Lovable, Replit and Base44 are allowed by the API's cross-origin rules; another origin can be added on request.
Yes, that is what it is for. Claims are one at a time and respect dependencies, so two agents, or an agent and a person, never hold the same task and nothing starts before what it depends on. Agents on any harness can claim work, over the REST API, the agent skill or MCP.
A run ended with evidence, the commands that were run and what they printed, and a judge found that evidence meets the criteria fixed at claim time. Only a verified run releases the tasks behind it. It is proof of work against criteria, not a claim that the work is true; in our own measurement the judge still flips about 1 run in 24 near the score floor.
In Claude Code, run /plugin marketplace add instruxi-io/agent-plugins, then /plugin install enforcer@instruxi, and restart Claude Code. Sign in with /enforcer:login 2R3L-76DC-YX7O to join the GVNR workspace (or use your own workspace code). The quickstart has the status line to paste.
Claude Code, fully. The governor runs in Claude Code's own hooks and sees every tool call before it runs, including the ones that cost nothing, like rm -rf or reading a credential file. Codex CLI: the same plugin installs with codex plugin install enforcer@instruxi, and its receipts, session and spend limits are Codex's own. It works, but it has been tested on Codex-shaped input only and not yet run against a live Codex. Grok Build is experimental: enforcer harness install grok puts it in place (try --dry-run first). Cursor, Gemini CLI, Hermes and OpenClaw are coming soon; meanwhile they can connect to your workspace through the Enforcer MCP server at https://api.instruxi.dev/mcp. Setup for each, or have your agent follow agents.md.
No. Without signing in, GVNR records on your machine, decides there too once you turn its checks on, and makes no network calls at all. Today GVNR is for personal use. Team use is coming soon: signing in to an Enforcer workspace will add one record for the whole team with a console, and organisation policy and settings.
Nothing until you sign in. Once signed in: decision receipts (verdict, rule, tool, model, tokens, project, operator; never command text, file contents or prompts), the session's project at each session start, a policy question naming the rule when one matches and you have turned the policy check on, and, only if you turn it on, Claude Code's own OpenTelemetry. All of it goes only to the workspace you signed in to, and each has its own switch.
None. Every check ships off: GVNR records and reports until you turn one on. Turn on the spend and rate checks with /enforcer:governor enable budget and the defaults are a $20 spend limit per agent, which stops the agent when reached, with a check-in at 75 percent where it asks you; the agent itself is told once at roughly two thirds. $2 a minute per agent, $10 a minute across all agents, 8 new agents a minute and 6 errors a minute each pause the agent and ask you. Day, week and month totals are off until you set them. The capability rules are a separate switch: /enforcer:governor enable rules.
Claude Code has permission rules that you write yourself to allow, ask or deny tools, and GVNR comes with a set of those you can paste in. It adds what permission rules do not: a receipt for each tool call, and, once you turn its checks on, spend and rate limits and a safer rewrite instead of a refusal, plus a shared team record once signed in. Loop detection it leaves to a judge such as jev-hooks.
The two halves fail in opposite directions on purpose. The rules need no state and fail closed, so they hold even when GVNR cannot read its own files. Spend and rate checks need state and fail open, saying so in the reason, because a guard that blocks real work over its own missing file gets uninstalled. Losing the network never allows more: the local rule decides alone.
GVNR is a guard against accidents and runaways, not a sandbox. Settings your organisation publishes cannot be lowered in the local config, but an agent with shell access on your machine can still interfere with its own guard. Against a deliberate adversary, isolate the agent and run GVNR on top.
GVNR itself works through hooks, not MCP, because an MCP tool is something an agent chooses to call and a hook is not. There are two. The enforcer plugin brings GVNR's MCP server, hosted by Instruxi at https://api.instruxi.dev/mcp, whose governance tools let your agent answer questions about your workspace's spend and decisions; other coding agents can add it directly. The GVNR team connector at https://mcp.gvnr.io/mcp is the other: ten tools for working one shared plan from a chat app such as Claude or ChatGPT, and nothing about cost or spend. AI Multiplayer explains it.
That was GVNR's 0.x line: a local proxy and browser dashboard, published on npm. It is retired. GVNR is now the agent governor described on this site, running in Claude Code today, and the npm package and its MCP Registry listing are not maintained.
It is source-available under the FSL-1.1-ALv2 licence: free to use, including commercially and in production, and each release becomes Apache 2.0 two years after it ships. You may not offer it as a competing product. It is not OSI open source.
The plugin is free. Your model provider still bills you as usual; once its checks are on, GVNR decides how fast, and on what, that money is spent. An Enforcer workspace, for the shared team record, is part of Instruxi's Enforcer service.
No, and it does not claim to. Nobody can do that reliably. Once its checks are on, it catches waste that is genuinely detectable, such as runaway spend and retry storms, blocks dangerous actions, and asks you about the judgment calls.