GVNR
GVNR, full name Enforcer Governor, is a free, self-hosted guard for AI agents. Before an agent action runs it answers allow, deny, or ask you, based on dollar-per-minute rate limits, a spend cap per session, loop detection and rules about what the agent may do. Every decision gets a hash-chained receipt.
No. GVNR at gvnr.io is free, runs on your own machine, needs no account, and is made by Instruxi. It ships as the npm package enforcer-governor. Nothing is sent to Instruxi.
It is source-available under the FSL-1.1-ALv2 licence: free to use and to self-host, and each release converts to Apache 2.0 two years after it ships. It is not OSI open source, so it is fairest to call it free and self-hosted.
Claude Code has its own permission rules, which you write yourself, that allow, ask or deny tools. GVNR ships a set of rules already switched on, and adds what permission rules do not: spend rate limits per agent and across all agents, loop detection, one control that stops every agent, spend split by project, and a receipt for each decision.
$2 a minute per agent, $10 a minute across all agents, 8 new agents a minute and 6 errors a minute; crossing any of those pauses the agent and asks you. A $20 cap per agent session stops it outright. Day, week and month caps across all agents are off until you set them.
Yes. Run npx -y enforcer-governor mcp from any MCP client, such as Cursor, Claude Desktop or Claude Code, with the governor running. It gives the agent five tools: ask permission before acting, status, recent decisions, verify the receipts, and stop an agent. None of them can loosen a limit. It is listed on the official MCP Registry as io.gvnr/enforcer-governor.
Claude Code, through a hook that sees every tool call before it runs. And anything that talks to an OpenAI- or Anthropic-shaped API, such as Cursor, the OpenAI and Anthropic APIs, Gemini, Grok, OpenRouter and local models, through a local proxy that meters and limits the model calls. And any MCP client, through the MCP server.
Nothing. It runs on your machine and nothing is sent to Instruxi. Your model providers still bill you as usual; GVNR decides how fast, and on what, that money is spent.
The Claude Code hook lets the action through and says so. A guard that breaks your agent whenever it is down gets uninstalled, so it fails open by design.
An agent with shell access could stop the GVNR process, and the hook then fails open. GVNR is a guard against accidents and runaways, not a sandbox. Against a deliberate adversary, isolate the agent and run GVNR on top.
You need Node.js. Run npx --yes enforcer-governor start in a terminal. The dashboard opens in your browser, and Ctrl+C stops it with your agents carrying on as normal.
No, and it does not claim to. Nobody can do that reliably. It catches waste that is genuinely detectable, such as loops and runaway spend, blocks dangerous actions, and asks you about the judgment calls.