AgentFuse

Deterministic, fail-closed tool-call authorization for AI agents — with evidence. Status: ALPHA · seeking the first real (non-self) deployment

AgentFuse is a pre-dispatch policy boundary for side-effect-capable AI agent tools, ported from the DHMS AgentFuse Python project (MkaliezZ/dhms-engine).

AGENTFUSE_IS_A_DANGER_CLASSIFIER=false
AGENTFUSE_IS_A_POLICY_AND_AUTHORIZATION_BOUNDARY=true
AGENTFUSE_DECISIONS=allow|block
AGENTFUSE_DEFERRALS=ask
AGENTFUSE_FAILS_CLOSED=true

A blocked call is a completed policy decision with non-execution evidence — never a failed tool execution. Evidence carries reason codes, policy ids, and a canonical arguments hash, never raw arguments or credentials.

Packages

The core is the product; the DSH package is one adapter. More adapters (LangGraph, Claude Code hooks, MCP) are on the roadmap.

Quickstart (DeepSeek Harness)

# cordis.yml (or a cordis.patch.yml insert)
- id: agentfuse
  name: '@deepseek-ai/dsh-agentfuse'
  config:
    defaultAction: block      # fail-closed fall-through
    denyTools: []             # deterministic block, always wins
    askTools: []              # defer to the DSH human-approval chain
    allowTools: []            # non-empty = only these names may run
    logDecisions: false       # durable evidence; needs in-repo catalog

See the adapter README for the policy order, the approval integration, and the install paths (bundle + PR).

Repository layout

packages/
  core/            @agentfuse/core — zero runtime dependencies
  dsh-agentfuse/   @deepseek-ai/dsh-agentfuse — the DSH adapter (bundle)
ROADMAP.md         phases, version line, stop-lines

Relationship to DHMS

AgentFuse is the runtime-execution-control line of DHMS (Digital Hyperthymesia Memory Systems). The engine is a faithful TypeScript port of dhms_agentfuse's decision engine and agentfuse-evidence-schema-v0.1; decision and execution remain separate lifecycle facts.

License

Apache-2.0. See LICENSE.