Validate the call
Reject bad types, missing fields, unsafe paths, invalid entities, wrong destinations, and tools outside the registry.
Tool boundary →TOOL VALIDATIONAI agent reliability for tools that take real action
Let agents act.
Stop unsafe actions.
Mycelium sits between your agent and its tools. Configure the controls that matter, validate inputs and authority before execution, control the run, then establish outcomes and reconcile uncertainty afterward.
Python engine · TypeScript & Go clients · HTTP/JSON · MIT
25KPyPI downloads
Wrong answers can be corrected.
Wrong actions ship consequences.
Mycelium controls tool actions at the last responsible boundary: after the model proposes a call, through execution, and until the outcome is known or safely unresolved.
THE SAFETY SPECTRUM
One boundary. Many ways to stop harm.
Turn on the controls your workflow needs. They compose around the same tool-call path.
Constrain authority
Freeze the tool allowlist, require exact destructive grants, and re-check expiring authority and decide-time facts at the moment of use.
Scope & grants →SCOPE & AUTHORITYKeep context honest
Catch stale tool data, malformed message history, orphan results, duplicate IDs, and superseded checkpoints before the next action.
Context guards →CONTEXT INTEGRITYStop runaway behavior
Detect repeated tool patterns, enforce step/token/USD ceilings, and refuse “done” until required work is complete.
Run controls →RUN CONTROLProtect secrets & destinations
Block raw credentials before claim, use secret references, and keep writes inside host-approved destination policy.
Data safety →DATA SAFETYControl execution
Claim consequential actions, prevent concurrent execution, recover ambiguous outcomes, and return stored results when work already completed.
Execution control →EXECUTION CONTROLPractical reliability guide
Why did your agent run that tool twice?
Learn how stable action identity, durable claims, and outcome recovery help prevent duplicate effects when an agent retries.
ONE TOOL CALL / FIVE DECISIONS
The tool only runs after the boundary says yes.
Mycelium evaluates deterministic facts in order. A refusal is returned to the agent as a useful runtime outcome, not discovered later in a dashboard.
- 1Is the call valid?PASS
Schema, registry, entity, path, secret, destination.
- 2Is it authorized now?PASS
Frozen scope, object grant, authority window, current facts.
- 3Is the run still healthy?PASS
Fresh context, loop progress, budget, completion state.
- 4May this execution proceed?ALLOW
Durable claim, effect identity, lease, prior outcome.
- 5Execute the real toolRUN
Only now does the call cross the side-effect boundary.
ANY CHECK FAILSBLOCK
No tool body. No damage. A named reason returns to the runtime.
WHERE CONSEQUENCES LIVE
Payments are one example.
Every consequential tool belongs here.
Payments
Customer
messages
Infrastructure
Business
records
Files &
secrets
Subagents &
handoffs
MYCELIUMsafe action
boundary
boundary
USE IT FROM ANY LANGUAGE
One engine.
Any HTTP/JSON runtime.
Mycelium is open-source and self-hosted. Its safety engine remains Python, while a small sidecar gives TypeScript, Go, Java, Rust, and other applications the same doorway into it. Run one sidecar locally or coordinate multiple sidecars through shared PostgreSQL.
The TypeScript and Go packages are thin clients, not separate Mycelium engines. Other languages can call the same OpenAPI contract directly.
YOUR APPLICATION
TypeScript · Go · Java · Rust
↓ HTTP/JSON
SELF-HOSTED MYCELIUM SIDECAR
↓
Python engine + durable ledger
local or shared PostgreSQL profileAGENT-ASSISTED SETUP
Let your coding agent wire the boundary.
The repository ships a $mycelium-setup skill. It inventories your tools, classifies their effects, fills the YAML, wires the runtime, and runs Doctor and Verify. You still approve consequential classifications, identity, secrets, and provider access.
# in your coding agent
$ Use $mycelium-setup to protect this project.
DISCOVER tools + framework
CLASSIFY side effects
WIRE config + runtime
VERIFY doctor + failure scenariosPROVE THE PROTECTION
Inspect it. Break it. Verify it.
Doctor checks whether safety is configured and detectably wired. Verify exercises synthetic runtime failures. Provider Verify challenges reconciliation adapters with lag, ambiguity, duplicates, malformed handles, and forbidden writes.
$ mycelium doctor --config mycelium.yaml
# representative checks
PASS tool registry
PASS side-effect classification
PASS durable storage
PASS scope + policy wiring
$ mycelium verify --scenario simulation
PASS protection held under failureEARLY FIELD EVIDENCE
67 protected Gmail actions.
Zero observed duplicates.
This is evidence for one live execution lane, not the whole safety catalog. The lane exercised normal success paths; no genuine UNKNOWN outcome occurred, so live recovery remains untested. Audit the field notes ↗
THE HONEST BOUNDARY
Deterministic runtime controls, not judgment dressed up as certainty.
Mycelium ships deterministic guards for
execution, validation, loops, context integrity, completion, scope, secrets, destinations, destructive authorization, authority timing, and use-time facts.
It does not yet claim deterministic prevention for
hallucination, open-ended goal misalignment, or prompt injection. Those remain judgment or roadmap territory.
START WITH THE RISKIEST TOOL