Developers

Keep your loop. Change where it executes.

There is no Velone way to write an agent, because that is not the product. You wrap the place your agent already runs tools, and everything below that line becomes governed.

Start the quickstart

before / afterthe whole integration

# before
result = subprocess.run(cmd, shell=True)

# after
result = session.shell(cmd)
#   ↳ identity attached
#   ↳ policy evaluated
#   ↳ runs in a microVM
#   ↳ appended to evidence

01 / install

curl -fsSL velone.in/install.sh | sh

typescript

npm i @velone/sdk

python

pip install velone

go get velone.in/sdk

02 / the shape

One session, many governed calls.

import { Velone } from "@velone/sdk";

const velone = new Velone({ apiKey: process.env.VELONE_KEY });

// A session is the durable worker, not the request.
const session = await velone.sessions.create({
  name: "claims-bot",
  onBehalfOf: "user:mara@acme",
  ring: 2,
  policy: "./velone.policy.yaml",
  region: "eu-central",
});

// Tool calls cross the boundary. Denials throw, escalations wait.
const out = await session.shell("pytest -q tests/");

try {
  await session.http.post("https://api.stripe.com/v1/refunds", body);
} catch (e) {
  if (e instanceof velone.Denied) {
    // e.rule === "tools.stripe.refund.escalate"
    // the model can choose a different path
  }
}

// Suspend for a day; resume with the filesystem intact.
await session.suspend();

03 / surface

sessions: create, resume, suspend, fork, destroy, list. The lifecycle of a durable worker.
session.shell: Run a command in the sandbox. Streams stdout and stderr; returns exit code and duration.
session.files: read, write, list, and mount. Path-scoped by policy.
session.http: Outbound requests through the gateway with egress policy and credential injection.
session.mcp: Call a registered MCP server's tools with per-tool policy.
session.browser: Drive a managed Chromium instance under the same egress rules.
session.approve: Request and await human approval explicitly, when you want the gate in your own code.
evidence: query, export, verify, and replay. Read your own audit chain.

Full API reference

04 / local first

It runs on a laptop, with the same rules.

A dev-mode kernel runs locally against your policy file, so a denial that will happen in production happens on your machine first.

$ velone dev --policy velone.policy.yaml

  kernel        ring 2 · local microVM
  policy        velone.policy.yaml (v3)
  egress        deny by default · 3 allowed
  evidence      ./.velone/evidence.jsonl

  ready on http://127.0.0.1:7801

05 / questions

How much of our agent has to change?

The call sites where tools execute, and nothing else. Teams typically land the first integration in an afternoon and spend longer deciding what the policy should say than writing code.

Do you support streaming?

Yes. Shell output, HTTP responses, and browser events stream through. Policy is decided before the stream opens, so there is no mid-stream surprise.

What happens in tests?

A record-and-replay mode fakes the kernel from a captured evidence file, so unit tests do not need a sandbox. CI can also run against a real ephemeral ring if you prefer.

Is there an OSS component?

The SDKs, the evidence verifier, and the policy compiler are Apache 2.0. The control plane and the host agent are not.

keep reading

QuickstartFirst governed session in five minutes.AdaptersClaude, Codex, LangGraph, CrewAI, and more.CLIInspect, replay, and diff runs.

Ring 0

Wrap one tool call and see what it catches.

Most teams find something alarming in the first hour. That is the point of the exercise.

Request access Quickstart