For security teams
For security teams: a decision on every tool call
AI coding agents run commands, edit files and call tools on developers' machines. Tempa puts a policy decision in front of each tool call, keeps secrets out of prompts, and keeps a record.
Controls
Guardrails before the tool runs
Every tool call is checked against the team's policies: allow, ask the developer, or deny with the reason. Tempa publishes per harness what happens when the check itself cannot run.
Secrets stay out
In Claude Code and Codex, a prompt that contains a secret or personal data such as a private key, an access token or an IBAN is stopped before it reaches the model provider. Where a harness cannot block a prompt, Tempa says so.
MCP under control
Only the MCP servers and tools you approve, per team, with credentials held by Tempa instead of on developers' machines.
An audit log
Every change to the configuration, every role granted and every sign-in, append-only and hash-chained.
What client-side enforcement means
Tempa's guardrails run in the developer's own agent, like the vendors' own settings do: a control for teams that work in good faith, not a barrier against someone determined to get around it. For regulated environments, the lock-down packs make Tempa's hooks mandatory through your device management.
Telemetry carries counts and pseudonyms. Prompt text and tool details stay out unless you switch them on for a team.