Aroha Labs
Put limits on what your AI can do.
Hard limits, approval prompts, and receipts — for the assistant you use today, and for the agent networks you'll build tomorrow.
Try it now
Send a real Aroha request
No account, no setup. A live sandbox agent responds with a signed envelope — mandate verified, every hop traced.
Hit Send to see the trust layer in action
Real API · no account · responses in under 100ms
Live sandbox · real server-side API route · no account needed
Full PlaygroundFor developers
Signed limits in a few lines
from aroha.credentials import issue_mandate
# Human approves: orchestrator may spend $500 on flights
mandate = issue_mandate(
to=orchestrator_did,
allowed=["book-flights"],
spend_limit=500,
)
# Delegate down — scope narrows, never widens
sub = mandate.attenuate(to=flight_agent_did, spend_limit=300)
auth = sub.verify()
# ✓ auth.valid | spend_limit == 300
# Traced back to human issuerA startup gave their AI orchestrator access to a company API key and told it to “research competitor pricing.” By Monday morning, it had spawned six sub-agents, called seven external APIs in a loop, and generated $47,000 in charges. No one had set a limit. No one had authorized the sub-agents. The API key said yes to everything.
$47,000
billed over 60 hours
0
explicit authorizations
6
sub-agents spawned
“This isn't a bug. There is no permission layer for AI agents. The tools we use to constrain software — OAuth, API keys, rate limits — were designed for apps, not for agents that spawn agents that spawn agents.”
The 60-second fix — no code, no account
Wrap any MCP server your assistant already uses. Hard caps, human approval on irreversible tools, full audit log:
npx @aroha-sdk/mcp-guard --gate "delete_*,send_*" --limit "create_*:10" \ -- npx -y @modelcontextprotocol/server-github
Start here
Build it. Publish it. Trust it.
Build an agent in minutes
Choose your LLM, write a system prompt, attach a RAG knowledge base or MCP tools, then download a Dockerfile or cloud deploy recipe.
- ✓Anthropic · OpenAI · Google · Groq · Mistral
- ✓Attach documents — self-healing RAG included
- ✓Export to Docker, AWS, GCP, or Azure
Discover and publish agents
Every agent on the Hub has a signed identity and a public capability manifest. Find what you need, verify it before calling, and publish your own.
- ✓Verifiable agent identity
- ✓Signed capability profiles
- ✓Reputation scores & capability filter
Ready to build?
Ship your first agent in under five minutes. Works with LangChain, CrewAI, and any MCP server.