Phinq
Open-source runtime governance layer that holds risky AI agent actions for human approval.
Last verified:
What is Phinq?
Phinq is an open-source runtime governance layer for AI agents that intercepts every tool call, classifies actions by risk level, automatically permits safe actions, and holds irreversible actions (deletes, credential reads, payments, bulk sends) for human approval before execution. It records all decisions in tamper-evident audit logs and works with Claude Code, Codex, LangChain, CrewAI, and other MCP agents.
Phinq pricing
Pricing model: Freemium
Free and open source (MIT licensed). Phinq Cloud beta available with 30% founder rate locked in for early adopters (first 200 members).
Phinq pros
- Open source (MIT licensed) and free with 2-minute installation; no control plane to configure
- Structural enforcement at the network/API boundary—the agent cannot ignore it, unlike advisory prompts
- Tamper-evident, hash-chained audit logs prove every decision; real-world data shows 377 actions held and 51 dangerous actions denied
- Compatible with multiple AI frameworks (OpenAI, Anthropic, Gemini, LangChain, CrewAI, Mastra, MCP) via proxy, SDK, or HTTP gate boundaries
Phinq cons
- Risky actions pause and wait for human approval—requires active decision-making and configured approval channels
- Still in beta stage; Phinq Cloud features are in early access rollout
- Effectiveness depends on proper risk classification rules and user configuration
Frequently asked questions about Phinq
How is Phinq different from a prompt or safety skill?
Prompts and skills are advisory—agents can choose to ignore them. Phinq intercepts tool calls at the API or execution boundary, so governance is structural and cannot be bypassed.
Does Phinq slow down my agent?
Safe, reversible actions pass through with no meaningful latency. Only risky actions wait for human approval, so the performance cost is paid exactly where you want oversight.
Is the audit log tamper-evident?
Yes. Every decision is recorded in a hash-chained, append-only log where each entry carries the hash of the previous one. Changing any byte breaks verification; one command proves the history is intact.