Cupcake

Cupcake is a policy enforcement layer designed for AI coding agents, aiming to improve performance, reliability, and security by evaluating agent actions against user-defined rules. Unlike approaches that consume model context for rule enforcement, Cupcake separates policy logic from the agent’s context, enabling deterministic rule-following and dynamic governance. It intercepts proposed actions from coding agents—such as running shell commands or editing files—and rapidly evaluates these actions against policies written in Open Policy Agent (OPA) Rego, compiled to WebAssembly for efficient, sandboxed execution. Decisions returned to the agent runtime can include allowing, blocking, halting, or modifying actions, along with human-readable feedback and optional context injection for supported agents.

The platform supports both deterministic and non-deterministic evaluation models. Deterministic policies guarantee consistent behavior given the same input, while the built-in Cupcake Watchdog feature leverages a secondary large language model (LLM) or agent to act as a judge, providing more adaptive oversight in scenarios where static rules may fall short. This allows for intelligent, on-the-fly determinations and dynamic policy gating, especially in cases where agents might be confused or manipulated beyond the scope of static rules. Additional capabilities include granular control over tools and arguments, native governance for Model Context Protocol (MCP) tools, first-class guardrail integrations with NeMo and Invariant for safety checks, and comprehensive observability through structured logs and evaluation traces for debugging.

Cupcake integrates natively with multiple AI coding agent harnesses, including Claude Code, Cursor, OpenCode, and Factory AI, using each harness’s native event formats and maintaining physically separated policies per harness. The tool can be embedded in JavaScript agent applications via TypeScript bindings, supporting integration with frameworks such as LangChain, Google ADK, NVIDIA NIM, and Vercel AI SDK. Enterprise-oriented features include audit trails, proactive warnings, and support for governance-as-code workflows.

Cupcake is positioned as a governance and policy enforcement solution for developers and organizations working with AI coding agents, providing both static and dynamic control mechanisms to ensure agents operate within defined operational and security boundaries.