cordum-io/cordum

git clone https://github.com/cordum-io/cordum.git && cd cordum && ./tools/scripts/quickstart.sh (one-command install from source)
Docker: go run ./cmd/cordumctl generate-certs, export CORDUM_API_KEY, docker compose pull && docker compose up -d
Kubernetes: helm install cordum oci://ghcr.io/cordum-io/cordum/charts/cordum --namespace cordum ...

Usage

• •export CORDUM_API_KEY=$(grep CORDUM_API_KEY .env | cut -d= -f2), then submit a governed job: curl -sS --cacert ./certs/ca/ca.crt -X POST https://localhost:8081/api/v1/jobs -H "X-API-Key: $CORDUM_API_KEY" ...
• •Run the demo: cordumctl pack install ./demo/quickstart/pack && cordumctl demo run quickstart
• •Claude Code compliance firewall: export CORDUM_GATEWAY/CORDUM_API_KEY/CORDUM_TENANT_ID then ./bin/cordumctl edge claude
• •MCP server: standalone stdio mode via cmd/cordum-mcp, or Gateway HTTP/SSE mode via /mcp/message and /mcp/sse (mcp.enabled=true)

Key features

• ✓Before/During/Across governance framework: Safety Kernel pre-execution policy evaluation, real-time monitoring + circuit breakers, fleet-wide audit trails
• ✓Human-in-the-loop approvals, output quarantine (blocks PII/secrets/hallucinations), pool segmentation, and risk-leveled policy decisions (ALLOW / DENY / REQUIRE_APPROVAL)
• ✓Cordum Edge — Compliance Firewall for local AI-agent actions: hook → local cordum-agentd → Gateway evaluate → resolved approval provenance → redacted evidence export
• ✓CAP (Cordum Agent Protocol) open standard for distributed agent governance; CAP v2 wire format frozen until February 2027
• ✓SDKs in Go, Python (cap-sdk-python), and Node (cap-sdk-node); 30+ integration packs (Slack, GitHub, AWS, Kubernetes, Terraform, Datadog, LangChain, MCP Bridge...)

Best for

Enterprise governance of autonomous AI agent fleets — safety gating, human approvals, and deterministic audit trails before risky agent actions run.

Caveats

• ⚠Licensed under Business Source License 1.1 (BUSL-1.1) — self-hosting and internal use permitted, but offering a competing hosted service is not; converts to Apache 2.0 on January 1, 2029
• ⚠Requires Docker Desktop v4+ / Engine v20.10+ (≥ 4 GB RAM), Go 1.26.3+ for cert generation
• ⚠Default dev dashboard login is admin / ChangeMe123! (CORDUM_ADMIN_PASSWORD) — must be changed before exposing the stack
• ⚠Enterprise features (SSO/SAML/OIDC, advanced RBAC, SIEM export) are shipped in core but unlocked by license entitlement
• ⚠Approval provenance is resolved-only: a requested approval event alone does not satisfy provenance for destructive retries