Runtime safety for agents that take real action

Let agents act.
Stop unsafe actions.

Mycelium sits between your agent and its tools. Configure the controls that matter, then validate inputs, scope, authority, context, and execution state before a call can touch the real world.

Protect your first tool

Framework agnostic · Python 3.10+ · Plain Python · MIT

25KPyPI downloads

AGENTrefund_order{order: "ORD-42"}

ARGS
VALID SCOPE
ALLOWED CONTEXT
FRESH AUTHORITY
CURRENT

MYCELIUM VERDICTALLOWsafe to execute

REAL TOOLrefund created

Wrong answers can be corrected.

Wrong actions ship consequences.

Mycelium prevents runtime failures at the last responsible moment: after the model proposes a tool call, before the tool can cause damage.

THE SAFETY SPECTRUM

One boundary. Many ways to stop harm.

Turn on the controls your workflow needs. They compose around the same tool-call path.

Validate the call

Reject bad types, missing fields, unsafe paths, invalid entities, wrong destinations, and tools outside the registry.

Tool boundary →

TOOL VALIDATION

Constrain authority

Freeze the tool allowlist, require exact destructive grants, and re-check expiring authority and decide-time facts at the moment of use.

Scope & grants →

SCOPE & AUTHORITY

Keep context honest

Catch stale tool data, malformed message history, orphan results, duplicate IDs, and superseded checkpoints before the next action.

Context guards →

CONTEXT INTEGRITY

Stop runaway behavior

Detect repeated tool patterns, enforce step/token/USD ceilings, and refuse “done” until required work is complete.

Run controls →

RUN CONTROL

Protect secrets & destinations

Block raw credentials before claim, use secret references, and keep writes inside host-approved destination policy.

Data safety →

DATA SAFETY

Control execution

Claim consequential actions, prevent concurrent execution, recover ambiguous outcomes, and return stored results when work already completed.

Execution control →

EXECUTION CONTROL

ONE TOOL CALL / FIVE DECISIONS

The tool only runs after the boundary says yes.

Mycelium evaluates deterministic facts in order. A refusal is returned to the agent as a useful runtime outcome, not discovered later in a dashboard.

1
Is the call valid?
Schema, registry, entity, path, secret, destination.
PASS
2
Is it authorized now?
Frozen scope, object grant, authority window, current facts.
PASS
3
Is the run still healthy?
Fresh context, loop progress, budget, completion state.
PASS
4
May this execution proceed?
Durable claim, effect identity, lease, prior outcome.
ALLOW
5
Execute the real tool
Only now does the call cross the side-effect boundary.
RUN

ANY CHECK FAILSBLOCK

No tool body. No damage. A named reason returns to the runtime.

WHERE CONSEQUENCES LIVE

Payments are one example.
Every consequential tool belongs here.

Payments

Customer
messages

Infrastructure

Business
records

Files &
secrets

Subagents &
handoffs

MYCELIUMsafe action
boundary

AGENT-ASSISTED SETUP

Let your coding agent wire the boundary.

The repository ships a $mycelium-setup skill. It inventories your tools, classifies their effects, fills the YAML, wires the runtime, and runs Doctor and Verify. You still approve consequential classifications, identity, secrets, and provider access.

See the setup contract Inspect the skill ↗

# in your coding agent
$ Use $mycelium-setup to protect this project.

DISCOVER tools + framework
CLASSIFY side effects
WIRE config + runtime
VERIFY doctor + failure scenarios

PROVE THE PROTECTION

Inspect it. Break it. Verify it.

Doctor checks whether safety is configured and detectably wired. Verify exercises synthetic runtime failures. Provider Verify challenges reconciliation adapters with lag, ambiguity, duplicates, malformed handles, and forbidden writes.

See verification Inspect source ↗

$ mycelium doctor --config mycelium.yaml
# representative checks
PASS tool registry
PASS side-effect classification
PASS durable storage
PASS scope + policy wiring

$ mycelium verify --scenario simulation
PASS protection held under failure

EARLY FIELD EVIDENCE

67 protected Gmail actions.
Zero observed duplicates.

This is evidence for one live execution lane, not the whole safety catalog. The lane exercised normal success paths; no genuine UNKNOWN outcome occurred, so live recovery remains untested. Audit the field notes ↗

THE HONEST BOUNDARY

Deterministic runtime controls, not judgment dressed up as certainty.

Mycelium ships deterministic guards for
execution, validation, loops, context integrity, completion, scope, secrets, destinations, destructive authorization, authority timing, and use-time facts.

It does not yet claim deterministic prevention for
hallucination, open-ended goal misalignment, or prompt injection. Those remain judgment or roadmap territory.

START WITH THE RISKIEST TOOL

Give your agent freedom.
Keep the boundary.