Stop risky agent actions before they commit.
flowifai sits between your AI agent and local MCP tools, asks a human before high-impact calls run, and leaves the real service credentials on your machine — the cloud approves, it never holds keys.
Demo: an AI agent's risky Stripe refund is gated by flowifai, approved by a human in the console, then executed with an audit record.
How it works
Install, connect, gate, decide.
Install the tools, connect one real MCP server, gate one risky call, then approve or deny it with an audit trail.
Connect a local MCP server
The signed CLI pairs with the app, inspects your server schema, writes private local config, and prints the wrapper path for Claude or another MCP client.
Choose the first guardrail
flowifai recommends policies from registered tools, such as gating refunds, deploys, destructive SQL, outbound email, and file deletes.
Review the exact request
When an agent hits a gated call, the request lands in the inbox with arguments, policy context, and approve/deny actions.
Keep a durable audit trail
Decisions, execution outcomes, and setup events are recorded so teams can review what happened after the agent run.
Where it earns its keep
Use it where agent mistakes are expensive
Start with one workflow you already hesitate to let an agent run unattended.
Role paths
Pick the path that matches your job
The same setup supports the person installing tools, the person setting policy, and the person approving work.
I install agents
Use the one-line installer, app-generated connect command, broker service, and strict doctor check.
Install tools →I manage policy
Start from recommended guardrails, preview matched calls, then keep raw CEL behind advanced controls.
Open policies →I approve actions
Review arguments before execution and approve or deny from the inbox. Notifications point back to the request.
Open inbox →I evaluate security
See what stays local, what the cloud stores, and where cooperative-control limits begin.
Read security model →The boundary
Credentials stay on the tools host.
The broker runs beside your MCP server and owns the local enrollment credential. The cloud stores policy, approval, audit, schemas, arguments, and execution records needed to make and review decisions — never your service keys.
Protocol-native approvals
Approval, delivered over the wire.
The approval decision is made server-side — against policy, audited, never by the agent's client. The gate is so cleanly server-side that approval can be delivered over the wire: when a gated call needs a human, supported clients surface the approval link natively, right in the conversation. Works today in Claude Code and VS Code. Every other MCP client gets the same gate with the link printed in the response — either way, the decision never comes from the client.
How it works in the docsProof
Built for the tools you already run.
Armen Shimoon — founder, Last Ridge
flowifai is built and run by Last Ridge, an independent software studio. It exists because we wanted to hand agents real tools — Stripe, prod databases, deploys — without handing them the keys. The gate you see above is the actual product, not a mock-up:the docs walk the same loop end to end.
Connect one agent and gate one real action.
Free for up to 2 agents. No credit card. The demo approval helps you learn the UI — the real thing is your first gated MCP call.