cupcake

# Cupcake

<p align="left">
  <picture>
    <source srcset="docs/docs/assets/cupcake-dark.png" media="(prefers-color-scheme: dark)">
    <img src="docs/docs/assets/cupcake.png" alt="Cupcake logo" width="180">
  </picture>
</p>

Make AI agents follow the rules.

[![Docs](https://img.shields.io/badge/docs-Start%20here-8A2BE2)](https://cupcake.eqtylab.io/)
[![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
[![Tests](https://img.shields.io/github/actions/workflow/status/eqtylab/cupcake/ci.yml?branch=main&label=tests)](https://github.com/eqtylab/cupcake/actions/workflows/ci.yml)
[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://github.com/eqtylab/cupcake/actions/runs/19737865145/job/56558251812)

**Policy enforcement** layer for AI agents; yielding better performance and security **without consuming model context**.

- **Deterministic rule-following** for your agents. [Interactive Examples](https://cupcake-policy-studio.vercel.app/example-policies/security/symlink-detection?harness=claude-code&format=rego)
- **Better performance** by moving rules out of context and into policy-as-code.
- **Trigger alerts** and put _bad_ agents in timeout when they repeatedly violate rules.

Cupcake intercepts agent events and evaluates them against **user-defined rules** written in **[Open Policy Agent (OPA)](https://www.openpolicyagent.org/) [Rego](https://www.openpolicyagent.org/docs/policy-language).** Agent actions can be blocked, modified, and auto-corrected by providing the agent helpful feedback. Additional benefits include reactive automation for tasks you dont need to rely on the agent to conduct (like linting after a file edit).

## Updates

**`2025-12-10`**: Official open source release. Roadmap will be produced in Q1 2026.

**`2025-04-04`**: We produce the [feature request](https://github.com/anthropics/claude-code/issues/712) for Claude Code Hooks. Runtime alignment requires integration into the agent harnesses, and we pivot away fro