Bounded

Decide what your coding agents may do, before they do it.

Bounded checks each action Claude Code, Codex or an MCP tool is about to take against rules you set, on your own machine. It allows it, asks you, or stops it.

Create accountSign in

For macOS and Linux.

  • Allowgit push origin feature/loginMatches your push rule.
  • Denygit push --force origin mainmain is protected. A task grant can’t change that.
  • Askpsql "$PROD_URL" -f migrate.sqlThe classifier says this touches production. Waiting for you.
Example decisions on one machine

How it works

  1. 1

    Pair a machine

    Install the CLI and run the pair command the console gives you. You confirm a short code; the machine gets its own identity.

  2. 2

    Choose the rules

    Start from a preset and adjust its settings, or edit the decision graph. Reuse parts across projects as modules.

  3. 3

    Publish and roll out

    Each machine applies the new policy and reports back. The console shows what every machine confirmed, not just what you saved.

  4. 4

    Agents act, checked locally

    Every action is decided on the machine. When a rule says ask, you answer in the agent where it supports that, or in your Bounded inbox.

What stays on your machine

The cloud keeps your settings and the approvals you give. The decision itself happens next to the agent.

Decisions run locally
The device evaluates the policy and task grants and makes the final call. An approval from the console is a choice the device checks, not a command it obeys.
Records upload only if you choose
Decision records stay on the device unless you turn uploads on, as verdict summaries or full records. A request you answer in the Bounded inbox is sent so you can review it.
Offline has limits you set
A disconnected machine keeps its last applied policy for the time you choose, then stops allowing anything automatically.
Models see only what you list
A classifier receives the fields you select, nothing else. Use Bounded’s hosted connection or your own key, which stays on your device.
Grants are narrow
A task grant covers the operations you approved, for one task, a set number of times, until it expires. The device checks each use.
A lock always wins
Lock a project on a machine and everything automatic there is denied, whatever the rules or grants say.

Works with

  • Claude Code
  • Codex
  • MCP tools, through the Bounded proxy

macOS and Linux. Windows later.

Start from a preset. Nothing runs until you publish.

Create accountI have an account