Which AI agent is doing what — and should it be allowed to?

Explore DeepSweep Studio™, a desktop workspace for reviewing agent permissions and inspecting policy decisions. See the preview below and try the browser demo.

Download DeepSweep Studio Try the editor extension now

The preview does not enforce permissions across your running agents.

1 · Review

Explore the Agent Environment Review: configured agents, their declared permissions, and configuration gaps to investigate.

2 · Authorize

Try allow, approval-required, and deny decisions in the browser demo. These examples illustrate policy behavior without controlling your agents.

3 · Audit

Inspect the preview of decision records: the agent, requested action, policy and verdict. Recording a decision is not proof that every action was intercepted.

DeepSweep Studio Review — configured agents and permissions — Review — configured agents and permissions

DeepSweep Studio Authorize — per-agent policy, deny wins — Authorize — per-agent policy, deny wins

DeepSweep Studio Audit — decision record preview — Audit — decision record preview

Explore it today

Browse the Studio development screenshots and try the policy demo below.
Download Studio for macOS, or choose Windows to register for early access.
For a configuration review in your editor today, use the DeepSweep extension.

MCP Security Gateway

Ships with Studio, available for macOS, not yet for Windows or Linux.

Runtime governance for AI agent tools

The gateway comes with the Studio desktop app. It is designed observe-first: it records and explains MCP tool calls routed through it, and enforcement turns on only when you say so. Routing an agent's tools through it needs Node.js installed where that agent runs. On Windows or Linux, the free review in your editor is what you can use today. The example below shows the kind of MCP findings it reports.

Signal Detect emerging concerns

Assess Analyze risk severity

Policy Generate guardrails

Enforce Apply your policy per call

Observe Monitor effectiveness

Refine Improve detection

Gateway

Example: what the free review reports

[FAIL] Unrestricted MCP Tool Access

[WARN] MCP Auth Disabled

[WARN] Remote MCP Server

[INFO] Sensitive Env Vars in MCP Config

Tool Call Review

Built to check MCP tool calls routed through it against your policy before the call is forwarded.

Approval-Gated Actions

A call your policy marks for a human is refused with a single-use approval token bound to that exact agent, action, resource, and argument set. A human approves it out of band, then the agent retries.

Rug-Pull Circuit Breaker

Tool descriptions are pinned on first sight. A changed description trips a breaker that refuses the call until a human re-approves the tool.

Evidence Ledger

Allowed, denied and held tool calls are written to a hash-chained local ledger with inclusion proofs. Records carry hashes of payloads, never your code.

DeepSweep Studio™

One desktop app to review your AI coding agents' permissions

See what each configured agent can reach — Cursor, Claude Code, Copilot, Windsurf and the rest — and preview per-agent allow, approval-required and deny decisions. Early access builds ship to the list first; the preview does not control your running agents.

Download DeepSweep Studio Download for macOS

DeepSweep Studio — per-agent authorization policy, where deny wins — Authorize — per-agent policy, deny wins. See every screen

LIVE policy v3

Every action, decided before it runs

…and written to evidence you can check

TREE HEAD …

Select an entry to recompute the head from its proof.

Timed in your browser and amortised over 5,000 evaluations per row. Browsers deliberately blunt their clocks, so anything under about 0.2 µs is below what this page can measure.

Real decisions from the real policy engine, and a real evidence ledger — running here, in your browser. Select any entry to verify its proof.

Signed installers, downloaded straight from deepsweep.ai. All builds and checksums See how it works