Agents propose. Cradle decides what may execute.
Rules live outside the agent, not in its prompt. Every decision lands in a log you can verify.
Runs on your hardware. Models and data never leave.
One gate between the agent and everything it can change
Your agent does not call tools directly. Every call goes through the execution gate first.
The agent proposes
Which tool, which arguments, on whose behalf — submitted as a typed proposal instead of a direct call.
Rules decide
No model involved. Permissions, tool registration, and the side-effect class from pure to irreversible. An unregistered tool cannot be called at all.
Irreversible actions wait for a person
Approval is scoped, expires, works once, and can never be granted by the same agent that asked for it.
The decision is written down
Proposal, decision, and what came back are appended to a hash-chained log, so an edit after the fact breaks the chain.
Three things that follow from that
Governed
The rule lives outside the agent and carries a version, so you can see which one allowed the call.
Sovereign
Your hardware, your network. Models and data do not leave it.
Auditable
An append-only log with a hash chain, checked by running a command rather than taking our word for it.
Install it where the work already happens
Cradle is an application you run yourself. The gate is inside it.
- 01Install the Cradle application on your own machine
- 02Run open-weight models locally through llama.cpp, or point it at an external provider when that is the right call
- 03Register the tools your agents may reach, each with the class of side effect it carries
- 04Keep the log on the same machine — nothing is sent anywhere to make it work
A separate server in Docker is available as an installation shape for shared setups. Running locally settles where your data lives; it is the gate above, not the location, that settles whether an action was allowed.
Put a gate in front of your agent.
Install it, register your tools, and see the first decision land in the log.