Deedglass Health: Deedglass Health Install
Install in 7 s Deedglass Health

New in 0.15.0: an app in your browser

Your AI agent says it did the right thing. Deedglass checks what it really changed.

Deedglass sits between your AI tools and your systems. Rules decide each action first; then it reads what really changed, locks a record anyone can check, and a person can put it back.

Open the app Try it in your browser
npx deedglass

One command in a terminal opens the console in your browser, signed in: no Docker, no account and no database to set up, and your records stay on this computer. It shows what your agents did, what is waiting for you to approve, and the locked records.

Developers: curl -fsSL https://deedglass.com/install.sh | sh installs the CLI on macOS or Linux, about 7 s on one network in India. Then deedglass start plays the 301-row scene with no questions. Or grade an MCP config in your browser. Healthcare teams: explore Deedglass Health → for FHIR R4 and clinical write verification.

See how it works

Deedglass installs on a computer, not a phone.

Output from deedglass play, scene 4 of 6, trimmed: the Postgres lines are replayed from a recorded run. The panel shows the same run.

Works with

  • Claude Code
  • Cursor
  • Windsurf
  • VS Code
  • Goose
  • OpenAI Agents SDK
  • LangChain

Connects to

  • Postgres
  • HAPI FHIR
  • Medplum
  • GitHub
  • Stripe sandbox
  • Slack
  • Notion
  • Gmail drafts

Product names and logos are trademarks of their owners. Shown to indicate compatibility, not endorsement.

public.orders 500 rows

support-bot

“Updated order 42. 1 row.”

The agent said
1 row
Postgres changed
301 rows

Doesn't match Postgres changed 301 rows in public.orders. The agent reported 1.

From our demo: a one-row update fires a legacy trigger, and 300 more rows change. Cell layout is illustrative; the counts are the run’s. Run it in your browser

How it works

Not what it asked. What it did.

One run from our demo: a one-row update, a trigger nobody mentioned, and 301 changed rows. Follow it down the page.

  1. Step 1 of 6

    The agent ships one order.

    A support agent sends one UPDATE through Deedglass. Your rule allows a single-order status change, so it runs. The tool answers UPDATE 1, and the agent reports one row.

  2. Step 2 of 6

    A trigger nobody mentioned fires.

    An old trigger on the orders table ships the next 300 open orders too. The agent can’t see it, and its tool still says one row.

  3. Step 3 of 6

    Postgres commits 301 rows.

    Deedglass doesn’t take the agent’s word. It reads Postgres’s own change log and counts every row that transaction changed.

  4. Step 4 of 6

    Deedglass says Doesn’t match, and shows the diff.

    One row was expected. 301 changed, 300 of them outside id = 42. Each row’s before and after goes into a sealed record.

  5. Step 5 of 6

    A person approves the undo.

    Putting rows back is a write too, so your rule asks a person first. Nothing changes until someone approves.

  6. Step 6 of 6

    All 301 rows go back.

    Deedglass puts every row back the way Postgres recorded it, then checks the undo the same way: Matches, Proven.

npx deedglass play
Or run it in your browser

From our demo: a recorded run of the trigger scene (14 October 2026) and the launch demo’s undo. Order ids, counts and the commit are the run’s; the cell layout is illustrative. npx deedglass play replays it in your terminal and labels which lines are live.

Who it’s for

One tool, three people who have to say yes.

Each gets the part they need. Pick yours.

  • The gate

    Platform engineers

    Put rules in front of every agent, including coding agents with a shell.

  • The record

    Security teams

    Get records you can check without trusting us, and the limits in writing.

  • Approvals

    Engineering leads

    Let teams use agents on production, with one switch to stop them all.

  • The benchmark

    Deedglass caught 5 of 11. The 6 misses are listed.

    Twelve cases where an AI agent’s report and the database differ, scored from Postgres’s own log.

For platform engineers

A gate for every agent, including the ones with a shell.

  • Rules before each call. Put an MCP server behind deedglass mcp wrap, or wrap a function with the SDK. Rules allow, block or ask a person.
  • Coding agents too. Once you turn it on, the shell guard asks you first when Claude Code is about to run prisma migrate reset, DROP TABLE or an UPDATE with no WHERE.
  • Watch a session. deedglass observe run starts your agent, then prints what Postgres committed on the watched tables while it ran, shell commands included, and saves the SQL to put it back.

The gate adds 5.81 ms to an allowed call at the median, 19.4 ms at p99 (our target was under 5 ms: missed). A write checked at Proven also waits for Postgres’s change log before the agent gets its answer: 118 ms at the median at 100 writes a second. Measured on an Apple M1 laptop. Method

Claude Code · BashReal output, deedglass 0.4.0
$ npx prisma migrate reset --force
Deedglass asks first: prisma migrate reset drops the database, or every table in it, and applies your migrations again, so its data is gone.

What runs where

The Deedglass server
One static binary, deedglass serve. Records, rules and the encrypted credential vault live in its own Postgres. No published image yet: build it from a checkout.
The gate
deedglass mcp wrap in front of an MCP server, or the SDK around your own function. The agent gets a Deedglass key, not the tool’s credentials.
The check
Proven reads your Postgres’s change log through a replication slot. It needs wal_level = logical and REPLICA IDENTITY FULL on the watched tables. The docs give the setting for RDS, Cloud SQL, Supabase, Neon and Azure, as guidance.
The seal key
One file on your Deedglass server. The public half lets anyone check records offline.
Read the quickstart

For security teams

Evidence you can check without trusting us.

  • A sealed record of every action. Which agent, for whom, which rule decided, who approved, what changed and what the check found, with SHA-256 fingerprints of the request and result.
  • Checked offline. Anyone with the public key can check the records, without an account and without us.
  • People approve. Only a person can approve, in the Console, by a one-use email link or a signed Slack click. An agent can never approve itself.
  • Credentials stay with Deedglass. The agent gets a Deedglass key; the real credential is encrypted and added only when the call goes out.
Threat model, limits and outbound calls
A sealed record in the Deedglass Console: postgres.execute by quickstart-agent, marked Sealed, Approval and Proven, Doesn’t match. The banner says Postgres changed 301 rows in public.orders and the agent reported 1; the checks are listed one by one, and the deed panel shows the seal key and a Check in this browser button. A sealed record in the Deedglass Console: postgres.execute by quickstart-agent, marked Sealed, Approval and Proven, Doesn’t match. The banner says Postgres changed 301 rows in public.orders and the agent reported 1; the checks are listed one by one, and the deed panel shows the seal key and a Check in this browser button.
A real record from Deedglass 0.10.0, on the demo’s made-up orders table: the check, the approval and the seal on one screen.
How far each system is checked today
How far each system is checked today
SystemLevel
PostgresProvenPostgres’s own change log
FHIR servers on Postgres (HAPI FHIR JPA 8.x, Medplum 5.x)Proventhe server’s own change log
MySQL, via Debezium (deedglass witness debezium, run offline beside an action)Provena Debezium change feed of what MySQL committed
GitHub, Slack, Notion, Gmail drafts, other FHIR servers, REST tools with a read-backCheckedread back after the call
Stripe (sandboxes only; a live key is refused)Checkedread back after the call
Other MCP tools, functions wrapped with the SDKClaimedthe tool’s own answer, recorded as such

Claimed: the tool said it worked. Checked: Deedglass read the result back from the system. Proven: the system of record’s own change log shows it.

If something goes wrong

  • Deedglass or its database is down

    Agents that go through it can’t act. It fails closed instead of letting calls through.

  • The shell guard can’t run

    The command goes ahead, unchecked. The guard is a second check next to Claude Code’s own rules, not a sandbox.

  • Nobody answers an approval

    It expires after the time the rule sets (30 minutes by default) and nothing runs. The agent is told so.

  • You need every agent stopped

    Stop all refuses every agent’s new actions on every instance within 2 seconds. A call a tool already received still happens.

  • Someone edits an old record

    Each record is linked to the one before, so the chain check names the changed record. Cutting the newest records off the end isn’t visible in the chain alone.

  • An agent skips Deedglass

    An agent that keeps its own credentials isn’t covered. The free scan lists the write paths that don’t go through your rules.

For engineering leads

Say yes to agents on production, with a record of every action.

  • One switch. An admin can stop one agent or every agent; only an owner starts them all again.
  • No rewrite. MCP agents point at Deedglass instead of the tool. Python and TypeScript agents add one wrapper.
  • Free while we grow. Every feature is free on your servers, including the ones that used to be Pro. Anything free today stays free for people who run it themselves.
  • If we stop. The core is Apache-2.0 and runs on your servers. Nothing calls home by default, and your records still check offline with your key.

Plainly: Deedglass is an independent systems project by Arjun Prabhakaran. There’s no SOC 2 report, no outside penetration test and no SSO yet. The source is on GitHub.

A pilot in four steps

  1. Scan

    Run npx deedglass scan in a repo your agents use. Read-only: it reads only your machine and any database you name.

  2. Watch the demo

    npx deedglass play in a terminal, or the browser version. No Docker, nothing sent.

  3. One agent on staging

    npx deedglass init, then put one agent’s Postgres or MCP server behind your rules.

  4. Decide

    Keep it. Every feature is free while we grow, and design partners receive dedicated direct engineering support.

Start with the scan

Set it up

Real commands. Copy, paste, run.

Every line here was run against a published release, deedglass 0.4.0. Every release since is in the changelog.

Grade what your agents can change.

Reads your MCP configs, Claude Code settings, packages and the names of database URL variables, and grades the setup A to F. Read-only: it reads only your machine and any database you name.

Needs Node

Terminal
npx deedglass scan

Ask first before a destructive command.

The plugin adds the Deedglass MCP server, /deedglass:scan, /deedglass:wrap, /deedglass:watch and the shell guard, off until you turn it on in .claude/settings.json. It needs a deedglass binary on your PATH and uses no network.

Needs Claude Code

Terminal
/plugin marketplace add deedglass/deedglass
/plugin install deedglass@deedglass

then in .claude/settings.json: { "env": { "DEEDGLASS_SHELL_GUARD": "ask" } }

Put an MCP server behind your rules.

Every tool call goes to the gate first and runs only if your rules allow it. The key is an agent key: npx deedglass init writes one to .deedglass/quickstart.key.

Needs A running Deedglass server (npx deedglass init)

Terminal
claude mcp add --env DEEDGLASS_API_KEY=<key> --transport stdio scratch -- \
  deedglass mcp wrap --connector scratch -- \
  npx -y @modelcontextprotocol/server-filesystem /tmp/deedglass-demo

See what a coding session changed.

Starts Claude Code inside a watched session. When it exits you see, per table, the row changes Postgres committed, shell commands included, and the SQL to put them back is saved for you to review.

Needs A Postgres connector with observe on

Terminal
deedglass observe run --connector <name> --undo-sql ~/deedglass-undo -- claude

Govern your own TypeScript tool.

Your function runs only if your rules allow it, at most once, and the outcome is sealed. What your code reports is recorded as Claimed; use a connector for Checked or Proven.

Needs Node 22.12+, Bun, Deno or an edge runtime

TypeScript
npm install @deedglass/sdk

import { Deedglass, wrapTool } from '@deedglass/sdk';
const dg = new Deedglass(); // DEEDGLASS_API_KEY, DEEDGLASS_SERVER
const refund = wrapTool(refundCustomer, { client: dg, tool: 'billing.refund_customer' });
await refund({ customer: 'cus_123', amount: 2000 });

Rules are lines you can read.

Two rules from the demo policy: UPDATE and DELETE need a WHERE clause, and an undo waits for a person. deedglass policy test runs your cases before you push.

Needs Any editor

policy.yaml
rules:
  - id: block-unscoped-writes
    match: { tool: [postgres.query, postgres.execute] }
    when: sql.unbounded_write
    decision: deny
    reason: UPDATE and DELETE need a WHERE clause.
  - id: undo-needs-approval
    match: { tool: "*.undo", connector_type: postgres }
    decision: require_approval
    reason: Undoing a write changes data again, so a human confirms it first.
    approval: { approvers: [role:admin], required: 1, expires_in: 30m }

Measured, not promised

Numbers we can show you, and how we got them.

  • 82 of 82

    attack cases end the way we wrote down before running them. We wrote the suite and run it ourselves; there has been no outside penetration test yet.

    See all of them

  • 23.5 ms

    the longest it took Stop to reach a second server, over 20 tries. Target under 2 s, met.

  • 1.53 s

    to check 100,000 records and every link between them. Target under 5 s, met.

    Check a record

  • 0 bytes

    that the free scan sends to us. It reads your files and, only if you name one, a database, read-only.

    Run it

Timings measured on an Apple M1 laptop, plugged in. The attack suite last ran on October 28, 2026.

Pricing

Free while we grow.

  • Always free

    • Rules: allow, block or ask a person
    • Checks: Matches, Doesn’t match, Can’t check
    • Sealed records you can check offline
    • Approvals, Stop and Insights
    • Undo of one agent action, after a person approves
    • deedglass scan and its A to F grade
    Try it in your browser

  • Every feature

    $0 while we grow

    • The full scan report, on your machine
    • Every policy pack, including the ones that used to be Pro
    • Undo of a whole watched session in one step
    • The security review pack
    • The agency view of every org you look after
    Start free

  • How you get it

    • Self-hosted
    • Open source
    • Community support
    Ask in GitHub Discussions

Later we will offer paid support, SLAs and a hosted version for organisations. Anything free today stays free for people who run Deedglass themselves. What free means. Cloud beta in November.

Questions

Good questions.

Anything else: hello@deedglass.com. A person answers.

What does Deedglass do, in one line?

Rules decide each AI agent tool call; Deedglass checks what really changed and seals a record.

Do I have to rewrite my agent?

No. MCP agents point at Deedglass instead of the tool. Python and TypeScript agents add one wrapper, with ready adapters for LangChain and the Claude Agent SDK, and in TypeScript for the OpenAI Agents SDK and the AI SDK. The agent gets a Deedglass key instead of the tool’s credentials.

Does it slow my agent down?

The gate adds 5.81 ms to an allowed call at the median and 19.4 ms at p99, measured on an Apple M1 laptop (our target was under 5 ms: missed). A Postgres write checked at Proven also waits for Postgres’s change log before the agent gets its answer: 118 ms at the median at 100 writes a second.

What does “Can’t check” mean?

We couldn’t read the result from the real system, so we say so instead of guessing. Connect that system and the same action gets checked.

What leaves my machine?

Nothing, by default. Deedglass runs on your own servers with your own Postgres. Every feature is free while we grow, so nothing checks a licence and nothing is sent to deedglass.com. The scan reads only your machine and any database you name. The deedglass licence commands, kept for a later paid option, are the only ones that call Dodo Payments or deedglass.com, and only when you run them. DEEDGLASS_NO_NETWORK=1 stops those calls. Every outbound call, and what turns it on, is listed on the security page.

What does it cost?

Nothing. Every Deedglass feature is free to use while we grow, including the ones that used to be Pro. Later we will offer paid support, SLAs and a hosted version for organisations. Anything free today stays free for people who run Deedglass themselves.

Can Deedglass protect healthcare and clinical records?

Yes. Deedglass Health provides write verification for FHIR R4 resources, ABDM, NHCX bundles, and hospital databases. High-risk clinical changes can require doctor approval before execution, with sealed records for quality and audit review.

What if Deedglass the company stops?

The core is Apache-2.0 and runs on your servers with your own Postgres. Nothing calls home by default, and your records still check offline with your public key.

Who is behind it?

Deedglass is an independent systems initiative founded by Arjun Prabhakaran to establish physical ground truth for autonomous AI agents. The core engine is open source under Apache-2.0, published on GitHub, and runs directly on your infrastructure with zero external telemetry.

Start here

Know what your agents really did.

Start with the free scan. It reads only your setup and any database you name.

Install in 7 s Scan your agent, free