Amparo EL AI Intelligence EL AI Intelligence

[an open agent that acts under policy — v0.10.0]

Capability is the market.
Accountability is the product.

Amparo is an open agent that acts under policy. Your model, your policy server, deny-by-default gates, human-only approval — and a ledger that answers for every consequential act.

install amparo operator surface →
$ amparo run "migrate the staging database"
[gate] registry: run_command — known
[gate] ceiling: ok — within user limits
[policy] /check → ask (destructive migration)
[approval] waiting on a human — 60 s fail-closed
[approval] approved by e@operator — 12 s
[exec] allowed — enforced
[ledger] recorded — counts, never values
4 stages before any action
60 s fail-closed approval
0 model approvers
1 append-only ledger
structural, not supervised

[story]

Built from an audit, aimed at the axis nobody claimed.

01

It started with an audit

A clean-sheet review of a full open agent OS found five criticals: an unauthenticated execution seam, red lines that failed open, a model approving its own actions. Guardrails bolted onto an agent loop fail. The gate chain had to be the architecture.

02

The market split left an axis empty

2026's agent market splits into camps — provider SDKs racing on capability, frameworks on reach, MCP at ~97M downloads a month — while policy is everywhere advisory, shaped by vendors, and unenforceable. Accountability stayed second-class.

03

The bet

Invert the product. Capability is borrowed — your model, your tools, any MCP mount. Accountability is built — deny-by-default, human-only approval, an append-only ledger. The result is the agent you can let act unattended, because the record answers for it.

[features]

Structural, not supervised.

Every framework sells guardrails as a feature. Here they are the architecture.

[gate] governance is the architecture
Every call walks registry → trust ceiling → policy engine → human approval. No member exits the chain — spawning a sub-agent is itself a gated call.
[policy] policy is external and yours
An open wire spec to whatever policy engine you run. Engine errors escalate — never execute. Swap the policy server without touching the agent.
[approver] a model is never the approver
Approval is always human, with reasons, blast radius, the delegation chain, and rollback hints in the copy.
[ledger] provenance and privacy are products
What acted, on what, with whose approval — with PII stripped, counts never values, command text never stored, denials recorded immediately.
[growth] self-improvement, gated
Skills are proposed, metered, and adopted through the same gate as everything else — then checked for drift and retired.
[posture] a binary, not a platform
Rust, Apache-2.0, one binary. MCP-native in both directions — serves tools, mounts others'.

[use cases]

When the cost of an unapproved action is higher than pressing a button.

01

The operator who wants to sleep

Unattended work — approval reaches your phone; sixty seconds of silence means denial.

02

One agent, ten clients

Workspaces per tenant, ceilings, session tags — the policy server sees every tenant.

03

Fintech ops with an auditor coming

Every external action lands in the ledger, with its approver and outcome.

04

The safe adoption path

Audit mode first — verdicts advisory, every check logged. Flip to enforce when ready.

05

Outbound messages, gated by a human

Every send names its destination and waits for a human.

06

Multi-agent work under a hard cap

Sub-agents share a budget that fails closed when exhausted.

07

Editing production, safely

Backup before change — the call aborts if the backup can't be made.

08

Untrusted computation

A WASM sandbox with metered fuel — untrusted code can compute, never touch the host.

[compare]

One axis, held.

Amparo doesn't compete on how much an agent can do. It competes on what an agent can do with your permission and your record. Its true counterpart is Hermes — built for autonomy without interruption. Same rejection of policy baked in by vendors; the opposite answer to the same question.

Amparo Hermes Agent Claude Agent SDK LangGraph OpenAI Agents SDK
Model supportBYO — OpenAI-compatible + AnthropicHermes 4 default; 400+ routedClaude onlyModel-agnosticOpenAI-centric
Action governanceGate chain, deny-by-defaultRedirect + self-recoveryPermission modes, hooksGraph approval gatesInput/output guardrails
Human approvalEvery consequential call, 60 s fail-closedOn requestConfigurable promptsConditional edgesNone built-in
MemoryTrait + built-in store; Engram recommendedBuilt-in, persistentSession resumeCheckpointed stateSession state
InteropMCP server + clientMCP + A2A200+ MCP serversMCP ecosystemMCP; handoffs
LicenseApache-2.0MITMITMITMIT

wins here

  • Unattended work — the agent stops for you, never around you: approval reaches your phone.
  • Multi-tenant and regulated contexts — ceilings per tenant, session tags, a ledger an auditor can read.
  • Policy that must bind — external, enforceable, swappable; engine errors escalate, never execute.
  • The adoption curve — audit mode lets you watch verdicts before they bind.

not the right tool here

  • Raw capability breadth — it rides your model and your MCP tools; it adds no secret capability of its own.
  • Frictionless autonomy — every consequential call waits for a human. That is the product.
  • Platform features — no hosted cloud, no vendor tool marketplace.

[install]

Bring it onto your device.

One command per platform. Checksums verified — no sudo, no secrets, no telemetry.

$ curl -fsSL https://downloads.ellmstack.dev/amparo/install.sh | bash
[install] ~/.local/bin/amparo — done

x86_64 and arm64 · checksums verified

$ curl -fsSL https://downloads.ellmstack.dev/amparo/install.sh | bash
[install] ~/.local/bin/amparo — ad hoc signed

apple silicon and intel · quarantine cleared + ad hoc signed at install

> irm https://downloads.ellmstack.dev/amparo/install.ps1 | iex
[install] %LOCALAPPDATA%\amparo\bin\amparo.exe — on PATH

powershell · x86_64 · no admin required

Phones don't run the agent — they drive it. Run Amparo on a server or your laptop, then operate it from anywhere:

  • operator surface — amparo.ellmstack.dev/app · add to home screen from your phone's browser
  • chat adapters — tasks and approvals arrive in Telegram, Discord, or Slack via amparo chat

Then point it at your model and your policy server:

$ AMPARO_INFERENCE_URL=https://your-model/v1 \
AMPARO_POLICY_URL=https://your-policy-engine \
amparo run "your first task"

apache-2.0 · bring your own LLM · no account