Introducing LaunchZero: capable AI agents with guardrails you control

An AI agent is only as useful as the things it’s allowed to do. The moment you let one read your files, run commands, or touch the network, it stops being a chat window and starts being a coworker with hands. That’s also the moment it becomes dangerous: the same agent can be jailbroken, fed a malicious web page, or steered by content it was never meant to obey - and now it has your credentials.

Most teams resolve that tension by giving up one side of it. They either keep the agent boxed in and useless, or they hand it broad access and hope nothing goes wrong. LaunchZero is the third option. It’s a local-first, zero-trust execution gateway that puts monitored tools and managed integrations behind policy, approvals, and Activity. Give the agent useful capabilities - with guardrails you control and can inspect.

Today, LaunchZero is free and open source on Windows, macOS, and Linux - and its full source is public on GitHub under our open-source license, for transparency. A zero-trust gateway should be inspectable; you shouldn’t have to trust a black box to guard your agent.

Gate in the moment, verify after the fact

The model fits in one sentence: the agent can be wrong, so governed requests are not trusted by default. LaunchZero decides requests through monitored tools and managed integrations before they run and records the result after.

• A per-tool policy engine resolves each governed request to one of three verdicts - Allow, Require Approval, or Deny.
• Human-in-the-loop approvals surface a real-time card when effective policy requires a decision, so you can review the exact request before governed execution.
• Execution capabilities are short-lived and one-shot. Durable grants are explicit, scoped, and reviewable.

Separate decisions from execution

LaunchZero isn’t one process that does everything. Three local processes have narrow jobs: GatewayServer decides, Executor handles governed execution, and HostIntegrity watches and scores for tamper signals. The agent-facing bridge is authenticated. In managed agent configurations, named native filesystem, runtime, and web-fetch built-ins are blocked so corresponding requests use monitored tools. Model-provider traffic, foreign MCP entries, and disclosed direct capabilities remain outside that mediation boundary.

Untrusted content can steer a tool-using agent toward an unintended action. LaunchZero does not try to judge every sentence as safe. It limits what those instructions can do through governed tools. For an approved request, LaunchZero computes a canonical hash of the action and checks the matching action again before governed execution. A changed action does not inherit the earlier approval. This control does not determine whether the original request was wise or benign.

Keys managed through LaunchZero live in an encrypted, machine-bound store rather than plaintext LaunchZero-managed configuration. LaunchZero-managed secrets are released only to authorized service identities; provider credentials remain within the agent’s configured trust boundary. Governed calls, approvals, denials, and executions land in Activity with provenance.

Local-first, and yours

LaunchZero’s policy, approval, governed execution, and Activity path runs on your own hardware, with no LaunchZero cloud in the enforcement path. Model providers and other disclosed direct capabilities can still connect to their external services.

Start with the quickstart

LaunchZero is built by Security Research Group, a founder-led cybersecurity firm of former NSA and U.S. Cyber Command operators. Download the free, open-source core for Windows, macOS, or Linux, then follow the quickstart to connect an agent and reach a workspace with governed tools in minutes.

• Download LaunchZero, then follow the quickstart.
• If you are evaluating the controls first, review the security model.

The source remains public so you can inspect the gateway before trusting it with your machine.