withHuman

ai.withhumanPublished by withhuman.aiOfficial publisherv1.0.0Updated Nov 4, 2026

Set up human approval for your AI agents' tool calls.

VerifiedStreamable HTTPWeb executableProductivity & WorkflowDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

withHuman is an approval layer that lets an assistant route its consequential tool calls to a human for approval, denial or automatic clearance before they run.

What you can do
  • Check agent tool calls against approval rules before they execute
  • Approve, deny or hold routine and consequential calls based on tool and arguments
  • Route pending requests to reviewers by email, Slack or Discord with escalation by team, level and working hours
  • Let reviewers decide in a web app with the exact call arguments in front of them
  • Connect coding agents and custom frameworks through adapters and SDKs
When to use it
Use it when an assistant should take real actions such as refunds, deployments or code merges, and a person must sign off on the risky ones first. It suits teams that want one place to define which agent actions run automatically, which are blocked and which wait for a reviewer.
Requirements
The hosted service is a remote endpoint requiring OAuth sign-in. Self-hosting needs Docker (or Go and Node to run from source), a bootstrap secret, and for anything beyond a local machine: HTTPS behind a proxy, WITHHUMAN_PUBLIC_ORIGIN, WITHHUMAN_TRUSTED_PROXIES, WITHHUMAN_SECRETS_KEY, SMTP settings and data-directory backups. Agents connect via the withhuman CLI or AAP SDKs.
Before you install
It sits in front of actions that change things, so misconfigured pipelines could let consequential calls through or block routine ones. Self-hosting requires protecting WITHHUMAN_SECRETS_KEY and the bootstrap secret, and backing up the data directory. The self-hosted build sends a daily telemetry ping with an installation ID, version and platform unless WITHHUMAN_TELEMETRY=off or DO_NOT_TRACK=1 is set. The hosted version adds audit logging, an AI judge, an MCP gateway, phone notifications and…

Installation

In SourceWeft

  1. Open withHuman in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ai.withhuman%2Fwithhuman/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "withhuman": {
      "type": "http",
      "url": "https://app.withhuman.ai/api/mcp/v1"
    }
  }
}

README

[withHuman] [withHuman]

Approval layer for AI Agents
Put your most consequential agent actions behind human approvals, so your agents can do real work.

[Latest release] [Release build] [Docker image] [Go version] [License: Elastic 2.0] [Agent Approval Protocol] [Chat on Discord] [Follow @withHumanAI on X]

Website · Docs · Quickstart · Protocol · Discord · Contributing

We want agents to do more than read data and suggest what to do next. They should be able to roll back a deployment, issue a refund, or merge code. Those actions have consequences, and teams need a way to bring a person in before they happen.

withHuman is the approval layer for that moment. It checks an agent's tool call before it runs against rules you define in one place. Routine calls can be approved automatically, disallowed calls can be denied, and consequential ones can wait for the right person to decide. Every agent you connect follows those rules.

[The review page for a pending issue_refund request: its arguments, the agent's explanation, and Deny and Approve buttons] [The review page for a pending issue_refund request: its arguments, the agent's explanation, and Deny and Approve buttons]

How it works

An adapter (a runtime hook or an SDK wrapper) sends each tool call to withHuman before it runs, over the open Agent Approval Protocol.

mermaid
sequenceDiagram    participant Agent as Your agent    participant WH as withHuman    participant You as You    Agent->>WH: Wants to call issue_refund(amount: 75)    WH->>WH: Checks your approval pipeline    WH->>You: Asks for approval by email, Slack or Discord    You->>WH: Approve    WH->>Agent: Go ahead    Agent->>Agent: Runs issue_refund
  • Approval pipelines approve, deny or ask a person, based on the tool and its arguments. For example: approve refunds up to $20, ask payments above that.
  • Escalation paths choose who is asked and when, by team, level and working hours. Reviewers get email, Slack or Discord and decide in the web app with the exact arguments in front of them.

See How withHuman works for how the pieces fit together.

Quickstart

You need Docker.

sh
docker run -d --name withhuman -p 8080:8080 -v withhuman-data:/data quay.io/withhuman/bundle:latestdocker exec withhuman cat /data/bootstrap-secret

Open http://localhost:8080, choose First setup and enter the secret. The welcome page connects your first agent and ends with a test call for you to approve. The quickstart guide covers each step.

To run from source instead, install Go (the version in go.mod) and Node 25, then run make frontend && go run ./cmd/withhuman. The secret is in ~/.withhuman/bootstrap-secret.

Connect your agents

  • Coding agents. Claude Code, Codex, OpenClaw, Pi, Hermes and DeepSeek connect with the withhuman CLI:

    sh
    curl -fsSL https://downloads.withhuman.ai/install.sh | shwithhuman agent install --url https://approvals.example.com

  • Agents you build. LangGraph, Pydantic AI, the OpenAI Agents SDK, CrewAI, Mastra and other frameworks connect through the AAP SDKs. See the examples.

Explore further

Agent skills

Teach your coding agent to connect runtimes and write approval pipelines:

sh
npx skills add https://withhuman.ai

The skills live in skills/.

Deploy

Settings are environment variables, listed in .env.example. Before you go beyond your own machine:

  1. Serve it behind HTTPS and set WITHHUMAN_PUBLIC_ORIGIN to that origin.
  2. Set WITHHUMAN_TRUSTED_PROXIES to your proxy's addresses only.
  3. Set WITHHUMAN_SECRETS_KEY and keep it safe.
  4. Configure SMTP so invitations and password resets reach people.
  5. Back up the whole data directory.
  6. Set OTEL_EXPORTER_OTLP_ENDPOINT to collect its OpenTelemetry metrics.

Don't want to run it yourself? withhuman.ai hosts it and adds the audit log, the AI judge, the MCP gateway, phone notifications and single sign-on.

Telemetry

Once a day withHuman sends a random installation ID, its version, the platform and whether it runs as a binary, a container or on Kubernetes. The answer tells administrators about new releases and security fixes on the Version settings page. Nothing about your organizations, people, agents or requests is sent. Set WITHHUMAN_TELEMETRY=off (or DO_NOT_TRACK=1) to turn it off. See Updates and telemetry.

Community

License

withHuman is licensed under the Elastic License 2.0.

Source: README.md at commit 74b8b42

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.0LatestOct 14, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.