README
¶
Turn existing OpenAPI services into tools AI agents can discover and call under your rules.
The model may request a call. Veto checks policy, requires approval for a destructive call, and resolves credentials before your API runs. Declared relations name a linked operation. A trace records the decision.
The model proposes. Veto decides. Your API executes.
MCP, JSON lines on veto serve --json, and veto search, describe, and invoke are the same three capabilities. They share one runtime. Your services stay where they already run.
brew install aiveto/veto/veto
go install github.com/aiveto/veto/cmd/veto@latest
brew does not need Go. go install needs Go 1.27.1. Binaries are on GitHub Releases. A release also pushes ghcr.io/aiveto/veto.
See veto in action
veto-demo is the full walk. Harbor sells home goods. Orders, customers, and billing are the APIs. The walk follows a customer from an order, holds a delete until a person approves it, and keeps the secret out of the trace. make demo runs that story over the CLI, then over MCP. make mcp leaves Harbor listening and prints the config for Claude, Cursor, or ChatGPT. make cli is the same story through search, describe, and invoke.
This repo runs the relation, the held delete, and the redacted trace, then exits. No model key.
git clone https://github.com/aiveto/veto.git
cd veto
go run ./examples/two-apis
Someone asked who placed order 123.
orders.get returned customerId 7.
customers.get was called for 7 because the note said Order.customerId identifies customers.get.
orders.delete did not call HTTP until approved.
The trace left the secret out.
A delete waits
Agent requests the call -> pending ID; no upstream HTTP
Person accepts the form in the chat -> one matching invocation
TTY stdin and stdout: same sentence, y -> one matching invocation
Host without that form: veto approve <id> -> approved ID, then the agent submits it once
The approval is bound to the caller, the operation, and the parameters. Permission and confirmation run before credentials are fetched and before HTTP. An OPA allow does not skip those checks. A webhook or a command can notify your approval system. The server and veto approve share approval storage and signing configuration. confirmation: false in veto.yaml turns that gate off for the deployment. Unset leaves it on.
A per-caller limit stops a call before policy. Timeouts and retries apply to the call that is sent.
The next call is declared
relations:
- schema: Order
field: customerId
to: customers.get
Search returns the related ids and related_calls. Describe returns the note, such as Order.customerId identifies customers.get. The Go Follow API walks that link. Invoke runs one operation. Relations.
What the agent receives
The agent gets search, describe, and invoke. Over MCP the names are capabilities_search, capabilities_describe, and capabilities_invoke. veto --help-json is the contract. veto serve --json serves JSON lines for skills and scripts. Each line is one of those three. veto search, describe, and invoke are a shorthand for a human. Direct pins add a few operations beside those three. Grouped mode adds one tool per resource. Search matches the summary, tags, the path noun, and synonyms such as retire for delete. An overlay can add a word of your own.
Response shaping returns named fields and a bounded list, and marks pagination and truncation. A Go context pack holds rules, operation summaries, the conversation, relations, and a pending confirmation, inside a byte budget. The raw OpenAPI document stays out of the pack.
Connect your services
veto init writes veto.yaml for the OpenAPI files or URLs you name, and a relations.yaml stub if you do not have one. If veto.yaml is already there, init stops.
veto init orders.yaml customers.yaml
veto serve --stdio speaks MCP on stdin. veto serve --json serves JSON lines for skills and scripts. Authenticated Streamable HTTP serves the same runtime to a remote client.
Credentials come from the environment, OAuth, a caller-supplied token, token exchange, a command that returns headers, or a Go provider that signs the request. The agent does not perform that login. Authentication.
Commands for validate, doctor, preview, eval, check, and replay are in the setup guide.
veto validate --config testdata/veto.yaml
veto eval --config testdata/veto.yaml --case testdata/delete.yaml
veto serve --config testdata/veto.yaml --stdio
veto serve --config testdata/veto.yaml --json
testdata/veto.yaml is already written. eval runs the delete case in this repo. A call needs an API that is still listening, which is what veto-demo keeps up.
Scope
Pre-1.0. Public APIs may change.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package agent runs one turn.
|
Package agent runs one turn. |
|
openai
Package openai calls the OpenAI HTTP API for the openai provider key.
|
Package openai calls the OpenAI HTTP API for the openai provider key. |
|
Package agentmeta applies an agent.yaml overlay to a catalog.
|
Package agentmeta applies an agent.yaml overlay to a catalog. |
|
Package auth places a credential on an upstream call.
|
Package auth places a credential on an upstream call. |
|
Package bundle loads contracts, relations, and check cases.
|
Package bundle loads contracts, relations, and check cases. |
|
Package capability is search, describe, and invoke.
|
Package capability is search, describe, and invoke. |
|
Package catalog is the operation index shared by the runtime, the MCP server, and a generated client.
|
Package catalog is the operation index shared by the runtime, the MCP server, and a generated client. |
|
cmd
|
|
|
veto
command
Package main is the veto command.
|
Package main is the veto command. |
|
Package config loads veto.yaml.
|
Package config loads veto.yaml. |
|
Package credentials is how an embedder supplies material for one upstream call.
|
Package credentials is how an embedder supplies material for one upstream call. |
|
Package eval runs agent cases with the scripted model and the real policy path.
|
Package eval runs agent cases with the scripted model and the real policy path. |
|
examples
|
|
|
two-apis
command
Package main runs two contracts through one catalog.
|
Package main runs two contracts through one catalog. |
|
Package execute sends the HTTP call for one operation.
|
Package execute sends the HTTP call for one operation. |
|
Package flow runs a sequence of steps the model may name.
|
Package flow runs a sequence of steps the model may name. |
|
Package generate writes a Go client whose calls go through runtime.Invoke.
|
Package generate writes a Go client whose calls go through runtime.Invoke. |
|
internal
|
|
|
atomicfile
Package atomicfile writes a complete file by renaming a temporary sibling.
|
Package atomicfile writes a complete file by renaming a temporary sibling. |
|
jsonfield
Package jsonfield reads one field from a JSON object body.
|
Package jsonfield reads one field from a JSON object body. |
|
yamlfile
Package yamlfile checks one YAML document before a typed decode.
|
Package yamlfile checks one YAML document before a typed decode. |
|
Package jsonopts is the encode option for JSON sent to a client API.
|
Package jsonopts is the encode option for JSON sent to a client API. |
|
Package mcpserver is the MCP adapter for search, describe, and invoke.
|
Package mcpserver is the MCP adapter for search, describe, and invoke. |
|
Package memory stores turns for one run.
|
Package memory stores turns for one run. |
|
Package opa evaluates a Rego overlay.
|
Package opa evaluates a Rego overlay. |
|
Package openapi loads an OpenAPI document into a catalog.
|
Package openapi loads an OpenAPI document into a catalog. |
|
Package policy allows, checks, and confirms.
|
Package policy allows, checks, and confirms. |
|
Package replay reads OpenTelemetry spans.
|
Package replay reads OpenTelemetry spans. |
|
Package result is an HTTP result and the invoke errors returned to a caller.
|
Package result is an HTTP result and the invoke errors returned to a caller. |
|
Package runctx builds the context pack for one turn.
|
Package runctx builds the context pack for one turn. |
|
Package runtime is the invoke sequence shared by the CLI, MCP, and the library.
|
Package runtime is the invoke sequence shared by the CLI, MCP, and the library. |
|
Package semantics derives a note for an operation and applies a file overlay.
|
Package semantics derives a note for an operation and applies a file overlay. |
|
Package telemetry exports OpenTelemetry spans.
|
Package telemetry exports OpenTelemetry spans. |
|
Package valkey is a policy.Store for more than one veto process.
|
Package valkey is a policy.Store for more than one veto process. |