veto

io.github.aivetov0.1.4Updated Oct 3, 2026

Turn OpenAPI services into tools an agent can call under your rules.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Turns existing OpenAPI services into a searchable catalog of tools an agent can call, with policy checks, approval gates, and credential handling.

What it does
Veto exposes OpenAPI-described services to an MCP client through three tools: capabilities_search, capabilities_describe, and capabilities_invoke. The model proposes a call; Veto checks policy, requires approval for destructive calls, resolves credentials, and only then lets the API execute. Declared relations link operations (for example an order's customerId to customers.get), and a trace records each decision. Response shaping returns named fields with bounded lists and marks pagination or truncation.
When to use it
Use it when an assistant should call existing HTTP APIs described by OpenAPI rather than a hand-written tool per endpoint, and when you need policy enforcement, human approval for destructive operations, and credential resolution outside the model. It suits teams that want a shared runtime across MCP, CLI, and generated Go clients.
Requirements
Runs as a local process over stdio, installed via Homebrew, go install (Go 1.27.1), GitHub Releases binaries, or the ghcr.io/aiveto/veto image. Needs a veto.yaml naming the OpenAPI files or URLs, and a running API to call. Credentials come from the environment, OAuth, a caller-supplied token, token exchange, a command returning headers, or a Go provider. No authentication is declared for the MCP server itself.
Before you install
It can perform destructive calls such as deletes; approval is required by default but confirmation: false in veto.yaml turns that gate off deployment-wide. Credentials are resolved before HTTP and kept out of traces, but the server and veto approve share approval storage and signing configuration. Pre-1.0, so public APIs may change. Traces are OpenTelemetry with optional OTLP export.

Installation

In SourceWeft

  1. Open veto in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[veto makes it possible for an AI agent to call your API with context and semantics. A hundred endpoints stay 3 tools.]

Turn existing OpenAPI services into tools AI agents can discover and call under your rules.

The model may request a call. Veto checks policy, requires approval for a destructive call, and resolves credentials before your API runs. Declared relations name a linked operation. A trace records the decision.

The model proposes. Veto decides. Your API executes.

Connect an MCP client, or embed the Go runtime. MCP, the CLI, eval, and a generated Go client share that runtime. The client calls the catalog through search, describe, and invoke. A hundred endpoints do not become a hundred tools. Your services stay where they already run.

bash
brew install aiveto/veto/veto
bash
go install github.com/aiveto/veto/cmd/veto@latest

brew does not need Go. go install needs Go 1.27.1. Binaries are on GitHub Releases. A release also pushes ghcr.io/aiveto/veto.

See veto in action

veto-demo is the full walk. Harbor sells home goods. Orders, customers, and billing are the APIs. The walk follows a customer from an order, holds a delete until a person approves it, and keeps the secret out of the trace. make demo runs the story. make mcp leaves Harbor listening and prints the config for Claude, Cursor, or ChatGPT.

This repo runs the relation, the held delete, and the redacted trace, then exits. No model key.

bash
git clone https://github.com/aiveto/veto.git
cd veto
go run ./examples/two-apis
text
Someone asked who placed order 123.
orders.get returned customerId 7.
customers.get was called for 7 because the note said Order.customerId identifies customers.get.
orders.delete sent no HTTP until approved.
The trace left the secret out.

A delete waits

text
Agent requests the call                          -> pending ID; no upstream HTTP
Person accepts the form in the chat              -> one matching invocation
Host without that form: veto approve <id>        -> approved ID, then the agent submits it once

The approval is bound to the caller, the operation, and the parameters. Permission and confirmation run before credentials are fetched and before HTTP. An OPA allow does not skip those checks. A webhook or a command can notify your approval system. The server and veto approve share approval storage and signing configuration. confirmation: false in veto.yaml turns that gate off for the deployment. Unset leaves it on.

A per-caller limit stops a call before policy. Timeouts and retries apply to the call that is sent.

The next call is declared

yaml
relations:
  - schema: Order
    field: customerId
    to: customers.get

Search returns the related operation. Describe returns the note, such as Order.customerId identifies customers.get. The Go Follow API walks that link. MCP invoke runs one operation. Relations.

What the agent receives

The tool names are capabilities_search, capabilities_describe, and capabilities_invoke. Direct pins add a few operations beside those three. Grouped mode adds one tool per resource. Search matches the summary, tags, the path noun, and synonyms such as retire for delete. An overlay can add a word of your own.

Response shaping returns named fields and a bounded list, and marks pagination and truncation. A Go context pack holds rules, operation summaries, the conversation, relations, and a pending confirmation, inside a byte budget. The raw OpenAPI document stays out of the pack.

Connect your services

veto init writes veto.yaml for the OpenAPI files or URLs you name, and a relations.yaml stub if you do not have one. If veto.yaml is already there, init stops.

bash
veto init orders.yaml customers.yaml

veto serve --stdio speaks MCP on stdin. Authenticated Streamable HTTP serves the same runtime to a remote client.

Credentials come from the environment, OAuth, a caller-supplied token, token exchange, a command that returns headers, or a Go provider that signs the request. The agent does not perform that login. Authentication.

Check it

TaskHow
The catalog loads, and its operation count and joins are printedvalidate
Missing auth, a colliding operation id, or a parameter that cannot be sentdoctor
The request and the policy decision, before a token is fetched and before HTTPpreview
Run a caseeval
Fail when a joined operation disappears, confirmation or a permission is dropped, a new destructive operation appears, or a case expectation changes. confirmation: false is the record of a deployment-wide dropcheck --against
Print a saved tracereplay --from
Run a messagereplay
Share contracts, relations, and cases apart from deployment credentialscapability bundle
Call the same runtime from your own Go modulegenerate a client, a CLI, and an MCP dispatch package

Traces are OpenTelemetry. OTLP export is optional. The Go model and memory interfaces, and sequential flows, run in-process. They are not a durable workflow service.

bash
veto validate --config testdata/veto.yaml
veto eval --config testdata/veto.yaml --case testdata/delete.yaml
veto serve --config testdata/veto.yaml --stdio

testdata/veto.yaml is already written, so these commands start at validate. eval runs the delete case in this repo. serve --stdio is the MCP process. A call needs an API that is still listening, which is what veto-demo keeps up.

Scope

Pre-1.0. Public APIs may change.

Setup guide | Current limits

Source: README.md at commit 5e5b0cb

Tools

0
Tool metadata has not been indexed yet.

Version history

1
  1. v0.1.4LatestOct 3, 2026